CVE-2020-8027

openldap uses fixed paths in /tmp

State: Published
Severity: 7.3 High
Published: Feb 11, 2021
Updated: Sep 16, 2024
Reserved: Jan 27, 2020

Description

A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This issue affects: SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.37.1. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.37.1. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.18.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.9.1.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H	suse

Weaknesses

CWE-377 Insecure Temporary File

Affected Products

Product	Versions
SUSE Linux Enterprise Server 15-LTSSSUSE	openldap2 to before 2.4.46-9.37.1Affected
SUSE Linux Enterprise Server for SAP 15SUSE	openldap2 to before 2.4.46-9.37.1Affected
openSUSE Leap 15.1openSUSE	openldap2 to before 2.4.46-lp151.10.18.1Affected
openSUSE Leap 15.2openSUSE	openldap2 to before 2.4.46-lp152.14.9.1Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=1175568

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.