CVE-2021-32554CWE-59CWE-61

apport read_file() function could follow maliciously constructed symbolic links

High · published June 12, 2021

CVSS v3.1
7.3
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.4th percentile
Weaknesses
CWE-59 · Improper Link Resolution Before File Access ('Link Following'); CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2021-06-12T03:40Z
EPSS history
Timeline
  • 12 JUN 03:40Z
    apport read_file() function could follow maliciously constructed symbolic links
    cvelistv5