CVE-2020-11934
published 2020-07-29CVE-2020-11934: It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in…
PriorityP424medium5.9CVSS 3.1
AVLACLPRLUIRSCCNIHAN
EPSS
0.36%
28.8th percentile
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | snapd | >= 2.45.1 < 2.45.1ubuntu0.2 | 2.45.1ubuntu0.2 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | snapd | < snapd 2.45.2-1 (bookworm) | snapd 2.45.2-1 (bookworm) |
| snapcraft | snapd | >= 0 < 2.45.2-1 | 2.45.2-1 |
| snapcraft | snapd | >= 0 < 2.45.2-1 | 2.45.2-1 |
| snapcraft | snapd | >= 0 < 2.45.2-1 | 2.45.2-1 |
| snapcraft | snapd | >= 0 < 2.45.2-1 | 2.45.2-1 |
| snapcraft | snapd | >= 0 < 2.45.1ubuntu0.2 | 2.45.1ubuntu0.2 |
| snapcraft | snapd | >= 0 < 2.45.1+18.04.2 | 2.45.1+18.04.2 |
| snapcraft | snapd | >= 0 < 2.45.1+20.04.2 | 2.45.1+20.04.2 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:N/I:P/A:N
osv6.8MEDIUM
vendor_ubuntu7.3HIGH
vendor_debian5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8cwp-mjww-pqc2: It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open
ghsa_unreviewed·2022-05-24
CVE-2020-11934 [LOW] GHSA-8cwp-mjww-pqc2: It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
OSV
CVE-2020-11934: It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open
osv·2020-07-29·CVSS 5.9
CVE-2020-11934 [MEDIUM] CVE-2020-11934: It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
OSV
snapd vulnerabilities
osv·2020-07-15·CVSS 6.8
CVE-2020-11933 [MEDIUM] snapd vulnerabilities
snapd vulnerabilities
It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and
Ubuntu Core 18 devices ran on every boot without restrictions. A physical
attacker could exploit this to craft cloud-init user-data/meta-data via
external media to perform arbitrary changes on the device to bypass
intended security mechanisms such as full disk encryption. This issue did
not affect traditional Ubuntu systems. (CVE-2020-11933)
It was discovered that snapctl user-open allowed altering the XDG_DATA_DIRS
environment variable when calling the system xdg-open. A malicious snap
could exploit this to bypass intended access restrictions to control how
the host system xdg-open script opens the URL. This issue did not affect
Ubuntu Core systems. (CVE-2020-11934)
Ubuntu
snapd vulnerabilities
vendor_ubuntu·2020-07-15·CVSS 7.3
CVE-2020-11933 [HIGH] snapd vulnerabilities
Title: snapd vulnerabilities
Summary: An intended access restriction in snapd could be bypassed by strict mode
snaps.
It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and
Ubuntu Core 18 devices ran on every boot without restrictions. A physical
attacker could exploit this to craft cloud-init user-data/meta-data via
external media to perform arbitrary changes on the device to bypass
intended security mechanisms such as full disk encryption. This issue did
not affect traditional Ubuntu systems. (CVE-2020-11933)
It was discovered that snapctl user-open allowed altering the XDG_DATA_DIRS
environment variable when calling the system xdg-open. A malicious snap
could exploit this to bypass intended access restrictions to control how
the host system xdg-open script opens
Debian
CVE-2020-11934: snapd - It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS env...
vendor_debian·2020·CVSS 5.9
CVE-2020-11934 [MEDIUM] CVE-2020-11934: snapd - It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS env...
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
Scope: local
bookworm: resolved (fixed in 2.45.2-1)
bullseye: resolved (fixed in 2.45.2-1)
forky: resolved (fixed in 2.45.2-1)
sid: resolved (fixed in 2.45.2-1)
trixie: resolved (fixed in 2.45.2-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-07-29
Published