CVE-2020-8022: User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges

First published: Fri Jun 26 2020(Updated: )

### Withdrawn As per https://lists.apache.org/thread/0z644xfjo49pn2oxcp9qslkvhhw4tb7q this issue only affects the SUSE built artifacts of tomcat and is not relevant for the artifacts on maven central. ### Original Advisory A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 80.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

Credit: meissner@suse.de meissner@suse.de

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• collector/nvd-index
• agent/software-canonical-lookup-request
• agent/weakness
• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-gc58-v8h3-x2gr
• alias/CVE-2020-8022
• agent/software-canonical-lookup
• agent/description
• collector/nvd-cve
• source/NVD
• agent/references
• agent/author
• agent/softwarecombine
• collector/github-advisory
• collector/ibm-support
• source/IBM
• collector/mitre-cve
• source/MITRE
• agent/title
• agent/last-modified-date
• agent/severity
• agent/event
• agent/first-publish-date
• agent/tags
• agent/trending
• vendor/apache
• canonical/apache tomcat
• vendor/suse
• canonical/suse enterprise storage
• version/suse enterprise storage/5.0
• canonical/suse linux enterprise server
• version/suse linux enterprise server/12-sp2
• version/suse linux enterprise server/12-sp3
• canonical/suse linux enterprise server sap
• version/suse linux enterprise server sap/12-sp2
• version/suse linux enterprise server sap/12-sp3
• canonical/suse openstack cloud
• version/suse openstack cloud/7.0
• version/suse openstack cloud/8.0
• canonical/suse openstack cloud crowbar
• version/suse openstack cloud crowbar/8.0
• version/suse linux enterprise server/12-sp4
• version/suse linux enterprise server/12-sp5
• version/suse linux enterprise server sap/15
• vendor/opensuse
• canonical/opensuse leap
• version/opensuse leap/15.1
• package-manager/maven
• vendor/ibm
• canonical/ibm qradar siem
• version/ibm qradar siem/7.5.0 ga
• version/ibm qradar siem/7.4.3 ga - 7.4.3 fp4
• version/ibm qradar siem/7.3.3 ga - 7.3.3 fp10