Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:0115-1

Опубликовано: 16 янв. 2020
Источник: suse-cvrf

Описание

Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issues:

Security issue fixed:

  • CVE-2019-19191: Fixed escalation to root by fixing ownership of log files (bsc#1157471).

Список пакетов

HPE Helion OpenStack 8
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Enterprise Storage 5
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server 12 SP1-LTSS
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server 12 SP2-BCL
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server 12 SP2-LTSS
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server 12 SP3-BCL
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server 12 SP3-LTSS
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server 12 SP4
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server 12 SP5
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE Linux Enterprise Software Development Kit 12 SP4
shibboleth-sp-devel-2.5.5-6.6.1
SUSE Linux Enterprise Software Development Kit 12 SP5
shibboleth-sp-devel-2.5.5-6.6.1
SUSE OpenStack Cloud 7
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE OpenStack Cloud 8
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1
SUSE OpenStack Cloud Crowbar 8
libshibsp-lite6-2.5.5-6.6.1
libshibsp6-2.5.5-6.6.1
shibboleth-sp-2.5.5-6.6.1

Ссылки

Описание

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.

Затронутые продукты
HPE Helion OpenStack 8:libshibsp-lite6-2.5.5-6.6.1
HPE Helion OpenStack 8:libshibsp6-2.5.5-6.6.1
HPE Helion OpenStack 8:shibboleth-sp-2.5.5-6.6.1
SUSE Enterprise Storage 5:libshibsp-lite6-2.5.5-6.6.1
Ссылки
Уязвимость SUSE-SU-2020:0115-1