CVE-2021-32547: apport read_file() function could follow maliciously constructed symbolic links
Published Jun 12, 2021
·Updated
It was discovered that readfile() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.
Affected Software
5 affected components
Ubuntu=18.04
Ubuntu=20.04
Ubuntu=20.10
Ubuntu=21.04
Ubuntu=21.10
Event History
Jun 12, 2021
CVE Published
via MITRE·03:40 AM
Data Sourced
via MITRE·03:40 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-32547?
CVE-2021-32547 is considered a medium severity vulnerability.
2
What can I do to mitigate CVE-2021-32547?
To mitigate CVE-2021-32547, ensure that you apply the latest security updates for Ubuntu Linux.
3
What versions of Ubuntu are affected by CVE-2021-32547?
CVE-2021-32547 affects Ubuntu versions 18.04, 20.04, 20.10, 21.04, and 21.10.
4
How does CVE-2021-32547 expose private data?
CVE-2021-32547 allows the read_file() function to follow symbolic links or open FIFOs, potentially exposing private data to local users.
5
Is there a permanent fix for CVE-2021-32547?
Yes, applying the patches from Ubuntu's security updates will provide a permanent fix for CVE-2021-32547.