CVE-2021-32553: apport read_file() function could follow maliciously constructed symbolic links

Published Jun 12, 2021

Updated

It was discovered that readfile() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.

Affected Software

6 affected components

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=20.04

Canonical Ubuntu Linux=20.10

Canonical Ubuntu Linux=21.04

Canonical Ubuntu Linux=21.10

ORACLE OpenJDK=17

Event History

Jun 12, 2021

CVE Published

via MITRE·03:40 AM

Data Sourced

via MITRE·03:40 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-32553?

CVE-2021-32553 is a vulnerability where the read_file() function in apport/hookutils.py can follow symbolic links or open FIFOs, potentially exposing private data to other local users.

How does CVE-2021-32553 affect Ubuntu Linux?

CVE-2021-32553 affects Ubuntu Linux versions 18.04, 20.04, 20.10, 21.04, and 21.10.

What is the severity of CVE-2021-32553?

The severity of CVE-2021-32553 is high with a CVSS score of 5.5.

How can I fix CVE-2021-32553?

To fix CVE-2021-32553, it is recommended to update the affected software to a patched version provided by the vendor.

Where can I find more information about CVE-2021-32553?

You can find more information about CVE-2021-32553 at the following reference link: [https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904](https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904)