未評価
Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disab...
CVE-2022-25366
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious .dylib file that can be executed via the DYLD_INSERT_LIBRARIES environment variable.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web cryptomator.org
- web medium.com