CVE-2019-18901: mysql-systemd-helper allows setting 640 permissions of arbitrary files

Published Mar 2, 2020

Updated

A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.

Affected Software

3 affected components

openSUSE Leap=15.1

SUSE Linux Enterprise Server=12

SUSE Linux Enterprise Server=15

Event History

Mar 2, 2020

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2019-18901 vulnerability?

CVE-2019-18901 is a UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12 and SUSE Linux Enterprise Server 15.

How does CVE-2019-18901 vulnerability affect SUSE Linux Enterprise Server?

CVE-2019-18901 allows local attackers to change the permissions of arbitrary files to 0640.

What is the severity of CVE-2019-18901 vulnerability?

CVE-2019-18901 has a severity level of medium with a score of 5.5.

How can I fix CVE-2019-18901 vulnerability?

Update the mariadb packaging of SUSE Linux Enterprise Server 12 and SUSE Linux Enterprise Server 15 to the patched version.

Where can I find more information about CVE-2019-18901 vulnerability?

You can find more information about CVE-2019-18901 vulnerability at the following references: - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html - https://bugzilla.suse.com/show_bug.cgi?id=1160895