Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:3386-1

Опубликовано: 23 дек. 2019
Источник: suse-cvrf

Описание

Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issues:

Security issue fixed:

  • CVE-2019-19191: Fixed escalation to root by fixing ownership of log files (bsc#1157471).

Список пакетов

SUSE Linux Enterprise Module for Server Applications 15
libshibsp-lite7-2.6.1-3.3.1
libshibsp7-2.6.1-3.3.1
shibboleth-sp-2.6.1-3.3.1
shibboleth-sp-devel-2.6.1-3.3.1
SUSE Linux Enterprise Module for Server Applications 15 SP1
libshibsp-lite7-2.6.1-3.3.1
libshibsp7-2.6.1-3.3.1
shibboleth-sp-2.6.1-3.3.1
shibboleth-sp-devel-2.6.1-3.3.1

Ссылки

Описание

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.

Затронутые продукты
SUSE Linux Enterprise Module for Server Applications 15 SP1:libshibsp-lite7-2.6.1-3.3.1
SUSE Linux Enterprise Module for Server Applications 15 SP1:libshibsp7-2.6.1-3.3.1
SUSE Linux Enterprise Module for Server Applications 15 SP1:shibboleth-sp-2.6.1-3.3.1
SUSE Linux Enterprise Module for Server Applications 15 SP1:shibboleth-sp-devel-2.6.1-3.3.1
Ссылки