CVE-2021-32549

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.
References
Link Resource
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*

History

15 Jun 2021, 15:26

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : 2.1
v3 : 5.5
CWE CWE-59
References (MISC) https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904 - (MISC) https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904 - Issue Tracking, Vendor Advisory
CPE cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*

12 Jun 2021, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-06-12 04:15

Updated : 2023-12-10 13:55


NVD link : CVE-2021-32549

Mitre link : CVE-2021-32549

CVE.ORG link : CVE-2021-32549


JSON object : View

Products Affected

canonical

  • ubuntu_linux
CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')

CWE-61

UNIX Symbolic Link (Symlink) Following