CVE-2021-32554

apport read_file() function could follow maliciously constructed symbolic links

State: Published
Severity: 7.3 High
Published: Jun 12, 2021
Updated: Sep 16, 2024
Reserved: May 10, 2021

Description

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L	canonical

Weaknesses

CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-61 UNIX Symbolic Link (Symlink) Following

Affected Products

Product	Versions
apportCanonical	2.20.1 to before 2.20.1-0ubuntu2.30+esm1Affected 2.20.9 to before 2.20.9-0ubuntu7.24Affected 2.20.11-0ubuntu27 to before 2.20.11-0ubuntu27.18Affected 2.20.11-0ubuntu50 to before 2.20.11-0ubuntu50.7Affected 2.20.11-0ubuntu65 to before 2.20.11-0ubuntu65.1Affected 2.14.1-0ubuntu3 to before 2.14.1-0ubuntu3.29+esm7Affected

References

https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.