CVE-2021-32554: apport read_file() function could follow maliciously constructed symbolic links
First published: Tue May 25 2021(Updated: )
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.
Credit: security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =20.04 | |
| Canonical Ubuntu Linux | =20.10 | |
| Canonical Ubuntu Linux | =21.04 | |
| Canonical Ubuntu Linux | =21.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-32554.
What is the severity of CVE-2021-32554?
The severity of CVE-2021-32554 is high.
Which software versions are affected by CVE-2021-32554?
The following versions of Canonical Ubuntu Linux are affected: 18.04, 20.04, 20.10, 21.04, and 21.10.
What is the description of CVE-2021-32554?
CVE-2021-32554 is a vulnerability in the read_file() function in apport/hookutils.py that could expose private data to other local users when used by the xorg package apport hooks.
How can I fix CVE-2021-32554?
To fix CVE-2021-32554, update to the latest version of the apport package.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/references
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/20.04
- version/canonical ubuntu linux/20.10
- version/canonical ubuntu linux/21.04
- version/canonical ubuntu linux/21.10