[manjaro-security] [ASA-202107-39] racket: sandbox escape
Jonas Witschel via arch-security
arch-security at lists.archlinux.org
Tue Jul 20 21:30:31 CEST 2021
Arch Linux Security Advisory ASA-202107-39
==========================================
Severity: Medium
Date : 2021-07-20
CVE-ID : CVE-2021-32773
Package : racket
Type : sandbox escape
Remote : Yes
Link : https://security.archlinux.org/AVG-2175
Summary
=======
The package racket before version 8.2-1 is vulnerable to sandbox
escape.
Resolution
==========
Upgrade to 8.2-1.
# pacman -Syu "racket>=8.2-1"
The problem has been fixed upstream in version 8.2.
Workaround
==========
None.
Description
===========
In Racket versions prior to 8.2, code evaluated using the Racket
sandbox could cause system modules to incorrectly use attacker-created
modules instead of their intended dependencies. This could allow system
functions to be controlled by the attacker, giving access to facilities
intended to be restricted.
Impact
======
Code executed in the Racket sandbox could escape its confinement
through attacker-created modules.
References
==========
https://github.com/racket/racket/security/advisories/GHSA-cgrw-p7p7-937c
https://github.com/racket/racket/commit/9877b84eaadd14e54e555b9f0ac8d784474795ce
https://security.archlinux.org/CVE-2021-32773
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20210720/dd3b624f/attachment.sig>
More information about the manjaro-security
mailing list