CVE-2019-3693

Опубликовано: 24 янв. 2020

Источник: nvd

CVSS3: 7.7

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html
Mailing List
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html
Mailing List
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1154328
Issue Tracking
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html
Mailing List
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html
Mailing List
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1154328
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:suse:mailman:*:*:*:*:*:*:*:*

Версия до 2.1.15-9.6.15.1 (исключая)

cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:a:suse:mailman:*:*:*:*:*:*:*:*

Версия до 2.1.17-3.11.1 (исключая)

cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:a:suse:mailman:*:*:*:*:*:*:*:*

Версия до 2.1.29-lp151.2.14 (включая)

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

EPSS

Процентиль: 38%

0.00168

Низкий

7.7 High

CVSS3

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-59

Связанные уязвимости

openSUSE-SU-2020:0148-1

suse-cvrf

около 6 лет назад

Security update for mailman

SUSE-SU-2019:3076-1

suse-cvrf

около 6 лет назад

Security update for mailman

SUSE-SU-2019:14230-1

suse-cvrf

около 6 лет назад

Security update for mailman

GHSA-mjp9-97x3-23vj

CVSS3: 7.8

github

больше 3 лет назад

EPSS

Процентиль: 38%

0.00168

Низкий

7.7 High

CVSS3

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-59