Advisory ROSA-SA-2023-2225

software: pesign 116
WASP: ROSA-CHROME

package_evr_string: pesign-116-1.src.rpm

CVE-ID: CVE-2022-3560
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC.: A flaw has been discovered in the design. The pesign package provides a systemd service used to run the pesign daemon. This service module runs a script to set ACL lists for the /etc/pki/pesign and /run/pesign directories to grant access rights to users in the “pesign” group. However, the script does not check for symbolic links. This could allow an attacker to gain access to privileged files and directories through a path traversal attack.
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update mosquitto