CVE-2021-3747: MacOS version of Multipass incorrect owner for application directory
The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
multipassto a version that resolves this vulnerability.Fixed in 1.7.2 - Configuration
For Multipass 1.7.0 on macOS, after upgrading to 1.7.2, ensure the Multipass application directory is owned by the correct user (it was accidentally installed with an incorrect owner in 1.7.0).
Multipass on macOS application directory owner = correct owner
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3747?
CVE-2021-3747 has a medium severity due to the potential for unauthorized access caused by the incorrect application directory owner.
How do I fix CVE-2021-3747?
To fix CVE-2021-3747, update Multipass to version 1.7.2 or later.
Which versions of Multipass are affected by CVE-2021-3747?
CVE-2021-3747 affects Multipass version 1.7.0 and earlier.
What software does CVE-2021-3747 apply to?
CVE-2021-3747 applies to the MacOS version of Canonical Multipass.
Is CVE-2021-3747 specific to MacOS?
Yes, CVE-2021-3747 is specifically related to the MacOS version of Multipass.