PT-2019-5774 · Debian · Sympa

Sylvain Beucler · Publicado 2019-01-08 · Atualizado 2022-11-08 · CVE-2020-26932

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Debian Sympa package versions prior to 6.2.40~dfsg-7

Description The issue is related to the debian/sympa.postinst component of the Sympa package, which sets incorrect permissions for the sympa newaliases-wrapper. This could allow a remote attacker to impact data integrity. The intended permissions are mode 4750, which allows access by the sympa group, but the current setting is mode 4755.

Recommendations For versions prior to 6.2.40dfsg-7, update to version 6.2.40dfsg-7 or later to resolve the issue. As a temporary workaround, consider changing the permissions of sympa newaliases-wrapper to mode 4750 to restrict access to the sympa group.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

BDU:2021-01769

CVE-2020-26932

DLA-2401-1

DSA-4818-1

Produtos afetados

Sympa

Referências · 30

• https://github.com/sympa-community/sympa/issues/1041 · Nota
• https://osv.dev/vulnerability/DSA-4818-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/sympa · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2020-26932 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26932 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10936 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26932 · Nota
• https://security-tracker.debian.org/tracker/CVE-2020-26932 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-26932 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29668 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DSA-4818-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26932 · Nota de Segurança
• https://t.me/cvenotify/7693 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9369 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26932 · Aviso do Fabricante