PT-2023-1337 · Pesign+8 · Pesign+8

Marco Benatto · Publicado 2023-01-31 · Atualizado 2025-03-26 · CVE-2022-3560

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pesign (affected versions not specified)

Description The issue is related to a path traversal attack in the pesign daemon, a systemd service. This could allow an attacker to gain access to privileged files and directories via a path traversal attack, potentially leading to elevated privileges. The vulnerability is due to the script not checking for symbolic links when setting ACLs for /etc/pki/pesign and /run/pesign directories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Improper Privilege Management

Enumeração de Fraquezas

CWE-22

CWE-269

Identificadores relacionados

ALSA-2023:1067

ALSA-2023:1572

ALT-PU-2023-4417

ALT-PU-2024-5107

ALT-PU-2024-7744

AZL-13293

BDU:2023-00640

CESA-2023_1093

CESA-2023_1572

CVE-2022-3560

INFSA-2023_1067

OESA-2023-1119

OESA-2023-1159

OPENSUSE-SU-2024:12672-1

RHSA-2023:1065

RHSA-2023:1066

RHSA-2023:1067

RHSA-2023:1093

RHSA-2023:1107

RHSA-2023:1572

RHSA-2023:1586

RHSA-2023:1829

RHSA-2023_1067

RHSA-2023_1093

RHSA-2023_1572

RLSA-2023:1067

RLSA-2023:1572

ROSA-SA-2023-2132

ROSA-SA-2023-2225

SUSE-SU-2023:0484-1

SUSE-SU-2023_0484-1

Produtos afetados

Alt Linux

Almalinux

Centos

Debian

Red Hat

Red Os

Rocky Linux

Suse

Pesign

Referências · 43

• https://github.com/rhboot/pesign/commit/d8a8c259994d0278c59b30b41758a8dd0abff998 · Nota
• https://bdu.fstec.ru/vul/2023-00640 · Nota de Segurança
• https://osv.dev/vulnerability/RLSA-2023:1067 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2023-1093.html · Aviso do Fabricante
• https://bugzilla.redhat.com/2135420 · Nota
• https://osv.dev/vulnerability/ALSA-2023:1572 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-efivar-cve-2022-35604529 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-3560 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2022-3560 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3560 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-13293 · Aviso do Fabricante
• https://osv.dev/vulnerability/RLSA-2023:1572 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2023-1159 · Aviso do Fabricante
• https://errata.almalinux.org/9/ALSA-2023-1067.html · Aviso do Fabricante
• https://errata.rockylinux.org/RLSA-2023:1067 · Aviso do Fabricante