Log in Start free

Vulnerability · Published Jun 12, 2021 · Assigned by canonical

CVE-2021-32549apport read_file() function could follow maliciously constructed symbolic links

High 7.3

In plain English

A high-severity security flaw in apport from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 78.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.

Affected products (as reported)

VendorProductVersions
Canonical apport 2.20.1 – before 2.20.1-0ubuntu2.30+esm12.20.9 – before 2.20.9-0ubuntu7.242.20.11-0ubuntu27 – before 2.20.11-0ubuntu27.182.20.11-0ubuntu50 – before 2.20.11-0ubuntu50.72.20.11-0ubuntu65 – before 2.20.11-0ubuntu65.12.14.1-0ubuntu3 – before 2.14.1-0ubuntu3.29+esm7

Weakness: CWE-59, CWE-61 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

References