inn: non-root owned files
CVE-2020-8026

8.4HIGH

Key Information:

Vendor

Opensuse
Status
Opensuse Leap 15.2
Opensuse Tumbleweed
Opensuse Leap 15.1
Vendor
CVE Published:
7 August 2020

What is CVE-2020-8026?

A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.

Affected Version(s)

openSUSE Leap 15.1 inn <= 2.5.4-lp151.3.3.1

openSUSE Leap 15.2 inn <= 2.6.2-lp152.1.26

openSUSE Tumbleweed inn <= 2.6.2-4.2

References

https://bugzilla.suse.com/show_bug.cgi?id=1172573
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthias Gerstner/Johannes Segitz of SUSE
.