Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2021-32553

apport read_file() function could follow maliciously constructed symbolic links

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical apport

  • 2.20.1 to < 2.20.1-0ubuntu2.30+esm1affected
  • 2.20.9 to < 2.20.9-0ubuntu7.24affected
  • 2.20.11-0ubuntu27 to < 2.20.11-0ubuntu27.18affected
  • 2.20.11-0ubuntu50 to < 2.20.11-0ubuntu50.7affected
  • 2.20.11-0ubuntu65 to < 2.20.11-0ubuntu65.1affected
  • 2.14.1-0ubuntu3 to < 2.14.1-0ubuntu3.29+esm7affected

References