CVE-2019-18899

🗓️ 23 Jan 2020 15:00:20Reported by suseType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 144 Views

The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1

Reporter	Title	Published	Views	Family All 16
Cvelist	CVE-2019-18899 apt-cacher-ng insecure use of /run/apt-cacher-ng	23 Jan 202015:00	–	cvelist
Debian CVE	CVE-2019-18899	23 Jan 202015:00	–	debiancve
EUVD	EUVD-2019-8580	7 Oct 202500:30	–	euvd
NVD	CVE-2019-18899	23 Jan 202015:15	–	nvd
Tenable Nessus	openSUSE Security Update : apt-cacher-ng (openSUSE-2020-124)	30 Jan 202000:00	–	nessus
OPENSUSE Linux	Security update for apt-cacher-ng (important)	29 Jan 202000:00	–	opensuse
OPENSUSE Linux	Security update for apt-cacher-ng (important)	29 Jan 202000:00	–	opensuse
OpenVAS	openSUSE: Security Advisory for apt-cacher-ng (openSUSE-SU-2020:0124_1)	30 Jan 202000:00	–	openvas
OSV	CVE-2019-18899	23 Jan 202015:15	–	osv
OSV	OPENSUSE-SU-2020:0124-1 Security update for apt-cacher-ng	29 Jan 202005:11	–	osv

NVD

Node

apt-cacher-ng_project apt-cacher-ngRange<3.1-lp151.3.3.1

AND

opensuse leapMatch15.1

Node

opensuse backportsMatchsle-15sp1

[
  {
    "vendor": "openSUSE",
    "product": "Leap 15.1",
    "versions": [
      {
        "version": "apt-cacher-ng",
        "status": "affected",
        "lessThan": "3.1-lp151.3.3.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.suse.com/show_bug.cgi
lists	www.lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html

21 Nov 2024 04:33Current

5.4Medium risk

Vulners AI Score5.4

CVSS 22.1

CVSS 3.15.5 - 6.2

EPSS0.0012

CWE-269