Описание
Security update for shibboleth-sp
This update for shibboleth-sp fixes the following issues:
Security issue fixed:
- CVE-2019-19191: Fixed escalation to root by fixing ownership of log files (bsc#1157471).
This update was imported from the SUSE:SLE-15:Update update project.
Список пакетов
openSUSE Leap 15.1
libshibsp-lite7-2.6.1-lp151.3.3.1
libshibsp7-2.6.1-lp151.3.3.1
shibboleth-sp-2.6.1-lp151.3.3.1
shibboleth-sp-devel-2.6.1-lp151.3.3.1
Ссылки
- E-Mail link for openSUSE-SU-2020:0020-1
- SUSE Security Ratings
- SUSE Bug 1157471
- SUSE CVE CVE-2019-19191 page
Описание
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
Затронутые продукты
openSUSE Leap 15.1:libshibsp-lite7-2.6.1-lp151.3.3.1
openSUSE Leap 15.1:libshibsp7-2.6.1-lp151.3.3.1
openSUSE Leap 15.1:shibboleth-sp-2.6.1-lp151.3.3.1
openSUSE Leap 15.1:shibboleth-sp-devel-2.6.1-lp151.3.3.1
Ссылки
- CVE-2019-19191
- SUSE Bug 1154062
- SUSE Bug 1157471