CVE-2021-32551: apport read_file() function could follow maliciously constructed symbolic links

Published Jun 12, 2021

Updated

It was discovered that readfile() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.

Affected Software

5 affected components

Ubuntu=18.04

Ubuntu=20.04

Ubuntu=20.10

Ubuntu=21.04

Ubuntu=21.10

Event History

Jun 12, 2021

CVE Published

via MITRE·03:40 AM

Data Sourced

via MITRE·03:40 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-32551?

CVE-2021-32551 is deemed to have a medium severity level due to the potential exposure of private data to local users.

How do I fix CVE-2021-32551?

To fix CVE-2021-32551, you should update your system to the latest version of the affected Ubuntu packages that include the security patch.

Which versions of Ubuntu are affected by CVE-2021-32551?

CVE-2021-32551 affects Ubuntu versions 18.04, 20.04, 20.10, 21.04, and 21.10.

What is the impact of CVE-2021-32551?

CVE-2021-32551 may allow local users to access sensitive information by exploiting the read_file() function in apport/hookutils.py.

Is CVE-2021-32551 a remote vulnerability?

No, CVE-2021-32551 is not a remote vulnerability as it requires local access to the system to exploit the issue.