CVE-2022-1227: Privilege escalation in github.com/containers/psgo
Summary
CVE-2022-1227: Privilege escalation in github.com/containers/psgo. Affects github.com/containers/psgo versions < 1.7.2. Fixed in 1.7.2. How to fix ↓
Also tracked for
- github.com/containers/podman/v3 · Go
- golang-github-containers-psgo · Debian:11
The same CVE-2022-1227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The github.com/containers/psgo package is a Go library that provides functionality for executing the 'nsenter' binary. It is commonly used in containerized environments to join namespaces and execute processes within those namespaces. The package includes various functions and utilities for managing namespaces and process information. However, a vulnerability has been discovered in the package that could potentially allow privilege escalation when used in environments where the 'nsenter' binary is provided by an untrusted source.
Vulnerability Detail
The vulnerability in github.com/containers/psgo arises from the execution of the 'nsenter' binary. If the 'nsenter' binary is provided by an untrusted source, an attacker could potentially exploit this to escalate their privileges. This could lead to unauthorized access, privilege escalation, and potential compromise of the system. The vulnerability affects versions 0 through 1.7.1 of the github.com/containers/psgo package.
How To Fix
Latest published version: v1.10.0 as of 23 Oct 2026
go get github.com/containers/psgo@v1.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.2
This is the first release that contains the fix.
go get github.com/containers/psgo@v1.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a possible workaround is to ensure that the 'nsenter' binary is obtained from a trusted source. This can be done by verifying the source and integrity of the 'nsenter' binary before using it with the github.com/containers/psgo package. Additionally, it is recommended to restrict access to the 'nsenter' binary and limit its usage to trusted users or processes.
Conclusion
In conclusion, the github.com/containers/psgo package is vulnerable to privilege escalation when used with an untrusted 'nsenter' binary. To mitigate this vulnerability, it is recommended to update to version 1.7.2 or later of the package. If updating is not immediately feasible, ensure that the 'nsenter' binary is obtained from a trusted source and restrict its usage. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/psgo →
FAQ
The vulnerability could allow an attacker to escalate their privileges, potentially leading to unauthorized access, privilege escalation, and compromise of the system.
Versions 0 through 1.7.1 of the github.com/containers/psgo package are affected by this vulnerability.
To fix this vulnerability, it is recommended to update to version 1.7.2 or later of the github.com/containers/psgo package.
If updating the package is not immediately feasible, a possible workaround is to ensure that the 'nsenter' binary is obtained from a trusted source and restrict its usage to trusted users or processes.
You can find more information about this vulnerability in the Open Source Vulnerability database at https://pkg.go.dev/vuln/GO-2022-0558.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
