CVE-2021-32550CWE-59CWE-61

apport read_file() function could follow maliciously constructed symbolic links

High · published June 12, 2021

CVSS v3.1
7.3
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.2th percentile
Weaknesses
CWE-59 · Improper Link Resolution Before File Access ('Link Following'); CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2021-06-12T03:40Z
EPSS history
Timeline
  • 12 JUN 03:40Z
    apport read_file() function could follow maliciously constructed symbolic links
    cvelistv5