DSA-5366: -1 multipath-tools -- security update

Published Mar 1, 2023

Updated

multipath-tools - security update

Other sources

The Qualys Research Labs reported an authorization bypass (CVE-2022-41974) and a symlink attack (CVE-2022-41973) in multipath-tools, a set of tools to drive the Device Mapper multipathing driver, which may result in local privilege escalation.

Affected Software

2 affected components

debian/multipath-tools

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade multipath-tools to a version that resolves this vulnerability.
Patch DSA-5366-1

Event History

Mar 1, 2023

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What level of access does an attacker need?

The reported issues may lead to local privilege escalation, so an attacker would need local access to the affected system.

What are the two reported vulnerability types?

The update addresses an authorization bypass tracked as CVE-2022-41974 and a symlink attack tracked as CVE-2022-41973.