Non évaluée
Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disab...
CVE-2022-25366
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious .dylib file that can be executed via the DYLD_INSERT_LIBRARIES environment variable.
Références
- advisory github.com
- advisory nvd.nist.gov
- web cryptomator.org
- web medium.com