7.8
CWE
378 668
Advisory Published
Updated

CVE-2021-25314: hawk: Insecure file permissions

First published: Wed Apr 14 2021(Updated: )

A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Availability 12-SP5, SUSE Linux Enterprise High Availability 15-SP2 allows local attackers to escalate to root. This issue affects: SUSE Linux Enterprise High Availability 12-SP3 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 12-SP5 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 15-SP2 hawk2 versions prior to 2.6.3+git.1614684118.af555ad9.

Credit: meissner@suse.de

Affected SoftwareAffected VersionHow to fix
Suse Hawk2<2.6.3\+git.1614685906.812c31e9-2.42.1
Suse Linux Enterprise High Availability Extension=12-sp3
Suse Hawk2<2.6.3\+git.1614684118.af555ad9
Suse Linux Enterprise High Availability Extension=15-sp2
Suse Hawk2<2.6.3\+git.1614685906.812c31e9
Suse Linux Enterprise High Availability Extension=12-sp5

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2021-25314?

    CVE-2021-25314 is a Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability.

  • How does CVE-2021-25314 impact SUSE Linux Enterprise High Availability?

    CVE-2021-25314 allows local attackers to escalate to root, posing a high security risk.

  • Which versions of hawk2 are affected by CVE-2021-25314?

    The versions affected by CVE-2021-25314 are up to and exclusive to 2.6.3+git.1614685906.812c31e9-2.42.1 and up to and exclusive to 2.6.3+git.1614684118.af555ad9.

  • Are SUSE Linux Enterprise High Availability Extensions 12-SP3 and 15-SP2 affected by CVE-2021-25314?

    No, SUSE Linux Enterprise High Availability Extensions 12-SP3 and 15-SP2 are not affected by CVE-2021-25314.

  • How can I fix CVE-2021-25314 in SUSE Linux Enterprise High Availability?

    It is recommended to update hawk2 to a version that is not vulnerable, such as a version higher than 2.6.3+git.1614685906.812c31e9-2.42.1 or 2.6.3+git.1614684118.af555ad9.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203