Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2022-21944

watchman: chown in watchman@.socket unit allows symlink attack

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openSUSE openSUSE Backports SLE-15-SP3

  • watchman to < 4.9.0affected

openSUSE Factory

  • watchman to < 4.9.0-9.1affected

References