Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cvelistSuseCVELIST:CVE-2020-8019
HistoryJun 29, 2020 - 11:30 a.m.

CVE-2020-8019 syslog-ng: Local privilege escalation from new to root in %post

2020-06-2911:30:14
CWE-61
suse
www.cve.org
1

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.6

Confidence

High

EPSS

0

Percentile

5.1%

JSON

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SUSE Linux Enterprise Debuginfo 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Debuginfo 11-SP4 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Module for Legacy Software 12 syslog-ng versions prior to 3.6.4-12.8.1. SUSE Linux Enterprise Point of Sale 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server 11-SP4-LTSS syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server for SAP 12-SP1 syslog-ng versions prior to 3.6.4-12.8.1. openSUSE Backports SLE-15-SP1 syslog-ng versions prior to 3.19.1-bp151.4.6.1. openSUSE Leap 15.1 syslog-ng versions prior to 3.19.1-lp151.3.6.1.

CNA Affected

[
  {
    "product": "SUSE Linux Enterprise Debuginfo 11-SP3",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "2.0.9-27.34.40.5.1",
        "status": "affected",
        "version": "syslog-ng",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "SUSE Linux Enterprise Debuginfo 11-SP4",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "2.0.9-27.34.40.5.1",
        "status": "affected",
        "version": "syslog-ng",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "SUSE Linux Enterprise Module for Legacy Software 12",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "3.6.4-12.8.1",
        "status": "affected",
        "version": "syslog-ng",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "SUSE Linux Enterprise Point of Sale 11-SP3",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "2.0.9-27.34.40.5.1",
        "status": "affected",
        "version": "syslog-ng",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "SUSE Linux Enterprise Server 11-SP4-LTSS",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "2.0.9-27.34.40.5.1",
        "status": "affected",
        "version": "syslog-ng",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "SUSE Linux Enterprise Server for SAP 12-SP1",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "3.6.4-12.8.1",
        "status": "affected",
        "version": "syslog-ng",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "openSUSE Backports SLE-15-SP1",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThan": "3.19.1-bp151.4.6.1",
        "status": "affected",
        "version": "syslog-ng",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "openSUSE Leap 15.1",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThan": "3.19.1-lp151.3.6.1",
        "status": "affected",
        "version": "syslog-ng",
        "versionType": "custom"
      }
    ]
  }
]

Related

openvas 2
nessus 2
cve 1
prion 1
nvd 1
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2020:14369-1)
2021-06-09 00:00:00
SUSE: Security Advisory (SUSE-SU-2020:1221-1)
2021-06-09 00:00:00
nessus
nessus
SUSE SLES12 Security Update : syslog-ng (SUSE-SU-2020:1221-1)
2020-05-15 00:00:00
SUSE SLES11 Security Update : syslog-ng (SUSE-SU-2020:14369-1)
2021-06-10 00:00:00
cve
cve
CVE-2020-8019
2020-06-29 12:15:10
prion
prion
Design/Logic Flaw
2020-06-29 12:15:00
nvd
nvd
CVE-2020-8019
2020-06-29 12:15:10

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.6

Confidence

High

EPSS

0

Percentile

5.1%

JSON
Related for CVELIST:CVE-2020-8019
openvas2nessus2cve1prion1nvd1