CVE-2019-18192: High severity gnu guix system distribution vulnerability
Published Oct 17, 2019
·Updated
GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365.
Affected Software
1 affected component
GNU Guix=1.0.1
Remediation
Patch Available
Event History
Oct 17, 2019
CVE Published
via MITRE·07:06 PM
Data Sourced
via MITRE·07:06 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-18192?
CVE-2019-18192 has a medium severity rating as it allows local users to access arbitrary user accounts.
2
How do I fix CVE-2019-18192?
To fix CVE-2019-18192, ensure that the parent directory of user-profile directories is not world writable.
3
Who is affected by CVE-2019-18192?
Users of GNU Guix version 1.0.1 are potentially affected by CVE-2019-18192.
4
What type of vulnerability is CVE-2019-18192?
CVE-2019-18192 is a local privilege escalation vulnerability.
5
Is CVE-2019-18192 related to any other vulnerabilities?
Yes, CVE-2019-18192 is similar to CVE-2019-17365, which also involves permissions issues.