CVE-2021-32556: apport get_modified_conffiles() function command injection
First published: Tue May 25 2021(Updated: )
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
Credit: security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Canonical Apport | >=2.14.1-0ubuntu3<2.14.1-0ubuntu3.29\+esm7 | |
| Canonical Apport | >=2.20.1<2.20.1-0ubuntu2.30\+esm1 | |
| Canonical Apport | >=2.20.9<2.20.9-0ubuntu7.24 | |
| Canonical Apport | >=2.20.11-0ubuntu27<2.20.11-0ubuntu27.18 | |
| Canonical Apport | >=2.20.11-0ubuntu50<2.20.11-0ubuntu50.7 | |
| Canonical Apport | >=2.20.11-0ubuntu65<2.20.11-0ubuntu65.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2021-32556.
What is the severity of CVE-2021-32556?
The severity of CVE-2021-32556 is low.
Which software is affected by CVE-2021-32556?
The Canonical Apport software with versions between 2.14.1-0ubuntu3 and 2.14.1-0ubuntu3.29+esm7, 2.20.1-0ubuntu2 and 2.20.1-0ubuntu2.30+esm1, 2.20.9 and 2.20.9-0ubuntu7.24, 2.20.11-0ubuntu27 and 2.20.11-0ubuntu27.18, 2.20.11-0ubuntu50 and 2.20.11-0ubuntu50.7, and 2.20.11-0ubuntu65 and 2.20.11-0ubuntu65.1 are affected.
How can CVE-2021-32556 be exploited?
CVE-2021-32556 can be exploited by injecting modified package names in a manner that would confuse the dpkg(1) call.
Is there a reference link for CVE-2021-32556?
Yes, you can find more information about CVE-2021-32556 at the following link: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/title
- agent/references
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/canonical
- canonical/canonical apport
- version/canonical apport/2.14.1-0ubuntu3
- version/canonical apport/2.20.1
- version/canonical apport/2.20.9
- version/canonical apport/2.20.11-0ubuntu27
- version/canonical apport/2.20.11-0ubuntu50
- version/canonical apport/2.20.11-0ubuntu65