USN-8914-1: Google Guest Agent, Google OS Config Agent vulnerability
Ubuntu USN-8914-1 patches Punycode handling in Google Guest Agent and OS Config Agent that allowed hostname access-control bypass and privilege escalation.
Ubuntu Security Notice USN-8914-1 addresses a flaw in the Go x/net/idna package vendored inside Google Guest Agent and Google OS Config Agent. The package incorrectly accepted Punycode-encoded labels that decode to ASCII-only labels when processing internationalized domain names. A remote attacker could exploit this to bypass hostname-based access controls and escalate privileges.
- Go x/net/idna mishandles Punycode labels in Google Guest Agent and OS Config Agent
- Remote attackers could bypass hostname-based access controls and escalate privileges
- Fix delivered as routine Ubuntu package update USN-8914-1
It was discovered that the Go x/net/idna package, vendored in Google Guest Agent and Google OS Config Agent, incorrectly accepted Punycode-encoded labels that decoded to ASCII-only labels when processing internationalized domain names. A remote attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges.
This source does not provide full text. Read it at ubuntu.com.