CVE-2021-32553

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
References
Link Resource
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*

History

16 Jun 2021, 13:08

Type Values Removed Values Added
References (MISC) https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904 - (MISC) https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904 - Issue Tracking, Vendor Advisory
CWE CWE-59
CPE cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 2.1
v3 : 5.5

12 Jun 2021, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-06-12 04:15

Updated : 2023-12-10 13:55


NVD link : CVE-2021-32553

Mitre link : CVE-2021-32553

CVE.ORG link : CVE-2021-32553


JSON object : View

Products Affected

canonical

  • ubuntu_linux

oracle

  • openjdk
CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')

CWE-61

UNIX Symbolic Link (Symlink) Following