CVE-2021-31997
python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-postorius version 1.3.2-lp152.1.2 and prior versions. openSUSE Factory python-postorius version 1.3.4-2.1 and prior versions.
Una vulnerabilidad de enlace simbólico de UNIX (Symlink) en python-postorius de openSUSE Leap 15.2, Factory permite a los atacantes locales escalar desde los usuarios postorius o postorius-admin a root. Este problema afecta a: openSUSE Leap 15.2 python-postorius versión 1.3.2-lp152.1.2 y versiones anteriores. openSUSE Factory python-postorius versión 1.3.4-2.1 y versiones anteriores
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-05-03 CVE Reserved
- 2021-06-10 CVE Published
- 2023-03-08 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-59: Improper Link Resolution Before File Access ('Link Following')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.suse.com/show_bug.cgi?id=1182407 | 2022-10-14 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Opensuse Search vendor "Opensuse" | Python-postorius Search vendor "Opensuse" for product "Python-postorius" | < 1.3.2-lp152.1.2 Search vendor "Opensuse" for product "Python-postorius" and version " < 1.3.2-lp152.1.2" | - |
Affected
| in | Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.2 Search vendor "Opensuse" for product "Leap" and version "15.2" | - |
Safe
|
Opensuse Search vendor "Opensuse" | Python-postorius Search vendor "Opensuse" for product "Python-postorius" | <= 1.3.4-2.1 Search vendor "Opensuse" for product "Python-postorius" and version " <= 1.3.4-2.1" | - |
Affected
| in | Opensuse Search vendor "Opensuse" | Factory Search vendor "Opensuse" for product "Factory" | - | - |
Safe
|