outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues (SUSE SUSE Linux Enterprise Server 12-SP4)
En bref
- Source
- NVD
- EPSS
- EPSS 0.47 % · centile 41 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- suse
- Statut NVD
- Modified
Description
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
Faiblesses (CWE)
- CWE-279 — Incorrect Execution-Assigned Permissions
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | suse |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | NVD · meissner@suse.de (Secondary) |
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2020-28937
- GCVE · GCVE-0-2020-8025
Configurations affectées (CPE NVD)
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15:*:*:*:espos:*:*:*cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15:*:*:*:ltss:*:*:*cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:ltss:*:*:*cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SUSE · SUSE Linux Enterprise Server 12-SP4 | affected permissions < 20170707-3.24.1 |
| SUSE · SUSE Linux Enterprise Server 15-LTSS | affected permissions < 20180125-3.27.1 |
| SUSE · SUSE Linux Enterprise Server for SAP 15 | affected permissions < 20180125-3.27.1 |
| openSUSE · openSUSE Leap 15.1 | affected permissions < 20181116-lp151.4.24.1 |
| openSUSE · openSUSE Tumbleweed | affected permissions < 20200624 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |