CVE-2019-18901

mysql-systemd-helper allows setting 640 permissions of arbitrary files

State: Published
Severity: 5.1 Medium
Published: Mar 2, 2020
Updated: Sep 17, 2024
Reserved: Nov 12, 2019

Description

A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.

Scores

CVSS	Score	Vector	Source
3.1	5.1 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L	suse

Weaknesses

CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

Product	Versions
SUSE Linux Enterprise Server 12SUSE	mariadb to before 10.2.31-3.25.1Affected
SUSE Linux Enterprise Server 15SUSE	mariadb to before 10.2.31-3.26.1Affected

References

openSUSE-SU-2020:0289vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=1160895

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.