CVE-2020-11934: It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in…

medium5.9CVSS 3.1

AVLACLPRLUIRSCCNIHAN

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
canonical	snapd	>= 2.45.1 < 2.45.1ubuntu0.2	2.45.1ubuntu0.2
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
debian	snapd	< snapd 2.45.2-1 (bookworm)	snapd 2.45.2-1 (bookworm)
snapcraft	snapd	>= 0 < 2.45.2-1	2.45.2-1
snapcraft	snapd	>= 0 < 2.45.2-1	2.45.2-1
snapcraft	snapd	>= 0 < 2.45.2-1	2.45.2-1
snapcraft	snapd	>= 0 < 2.45.2-1	2.45.2-1
snapcraft	snapd	>= 0 < 2.45.1ubuntu0.2	2.45.1ubuntu0.2
snapcraft	snapd	>= 0 < 2.45.1+18.04.2	2.45.1+18.04.2
snapcraft	snapd	>= 0 < 2.45.1+20.04.2	2.45.1+20.04.2

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

osv6.8MEDIUM