CVE-2021-32557 apport process_report() arbitrary file write

2021-06-1203:40:43

CWE-59

CWE-61

canonical

www.cve.org

cve-2021-32557

apport

data/whoopsie-upload-all

arbitrary file writes

CVSS3

5.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

AI Score

7.2

Confidence

High

EPSS

Percentile

12.8%

JSON

It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.

CNA Affected

[
  {
    "product": "apport",
    "vendor": "Canonical",
    "versions": [
      {
        "lessThan": "2.20.1-0ubuntu2.30+esm1",
        "status": "affected",
        "version": "2.20.1",
        "versionType": "custom"
      },
      {
        "lessThan": "2.20.9-0ubuntu7.24",
        "status": "affected",
        "version": "2.20.9",
        "versionType": "custom"
      },
      {
        "lessThan": "2.20.11-0ubuntu27.18",
        "status": "affected",
        "version": "2.20.11-0ubuntu27",
        "versionType": "custom"
      },
      {
        "lessThan": "2.20.11-0ubuntu50.7",
        "status": "affected",
        "version": "2.20.11-0ubuntu50",
        "versionType": "custom"
      },
      {
        "lessThan": "2.20.11-0ubuntu65.1",
        "status": "affected",
        "version": "2.20.11-0ubuntu65",
        "versionType": "custom"
      },
      {
        "lessThan": "2.14.1-0ubuntu3.29+esm7",
        "status": "affected",
        "version": "2.14.1-0ubuntu3",
        "versionType": "custom"
      }
    ]
  }
]