CVE-2021-32557 — Link Following in Apport

CWE-59 — Link FollowingCWE-61 — UNIX Symbolic Link (Symlink) Following6 documents5 sources
Severity
7.1HIGHNVD
CNA5.2
EPSS
0.1%
top 82.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Canonical ApportApport Project Apport
Timeline
PublishedJun 12
Latest updateMay 24

Description

It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages3 packages

▶CVEListV5canonical/apport2.20.1 — 2.20.1-0ubuntu2.30+esm1+5
▶NVDcanonical/apport2.14.1-0ubuntu3 — 2.14.1-0ubuntu3.29\+esm7+5
▶Ubuntuapport_project/apport< 2.20.9-0ubuntu7.24+3

🔴Vulnerability Details

3
GHSA
GHSA-ggh9-6q6m-3fh2: It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks↗2022-05-24
▶
CVEList
apport process_report() arbitrary file write↗2021-06-12
▶
OSV
CVE-2021-32557: It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks↗2021-05-25
▶

📋Vendor Advisories

2
Ubuntu
Apport vulnerabilities↗2021-05-25
▶
Ubuntu
Apport vulnerabilities↗2021-05-25
▶
CVE-2021-32557 — Link Following in Canonical Apport | cvebase