Advisory ROSA-SA-2023-2132

Software: pesign 0.109
OS: rosa-server79

package_evr_string: pesign-0.109-11

CVE-ID: CVE-2022-3560
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC: A flaw has been found in the design. The pesign package provides a systemd service used to run the pesign daemon. This service module runs a script to set ACLs for the /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the ‘pesign’ group. However, the script does not check for symbolic links. This could allow an attacker to gain access to privileged files and directories using a path traversal attack.
CVE-STATUS: Fixed
CVE-REV: To close, run the yum update command