Information Disclosure in qmail-verify from netqmail by Openwall

CVE-2020-3812

Summary

The qmail-verify component used in netqmail version 1.06 is susceptible to an information disclosure vulnerability. This flaw allows local attackers to determine the existence of files and directories throughout the filesystem. The issue arises from qmail-verify operating with root privileges and checking for files in the attacker’s home directory without reducing its access rights first. As a result, unauthorized users can exploit this weakness to gather sensitive information about the system's file structure.

References