CVE-2019-3690CWE-59

chkstat follows untrusted symbolic links

Medium · published December 5, 2019

CVSS v3.1
6.8
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.6th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2019-12-05T15:30Z
EPSS history
Timeline
  • 05 DEC 15:30Z
    chkstat follows untrusted symbolic links
    cvelistv5