PT-2023-6518 · Opensuse+1 · Opensuse Leap+3

Matthias Gerstner · Publicado 2023-08-23 · Atualizado 2024-06-15 · CVE-2023-32182

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions postfix versions prior to 3.7.3-150500.3.5.1 in SUSE Linux Enterprise Desktop 15 SP5 postfix versions prior to 3.7.3-150500.3.5.1 in SUSE Linux Enterprise High Performance Computing 15 SP5 postfix versions prior to 3.7.3-150500.3.5.1 in openSUSE Leap 15.5

Description The issue is related to an Improper Link Resolution Before File Access ('Link Following') vulnerability in the postfix package of certain SUSE and openSUSE operating systems. This vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For SUSE Linux Enterprise Desktop 15 SP5, update postfix to version 3.7.3-150500.3.5.1 or later. For SUSE Linux Enterprise High Performance Computing 15 SP5, update postfix to version 3.7.3-150500.3.5.1 or later. For openSUSE Leap 15.5, update postfix to version 3.7.3-150500.3.5.1 or later.

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

BDU:2023-07265

CVE-2023-32182

OPENSUSE-SU-2023_3394-1

OPENSUSE-SU-2023_3791-1

OPENSUSE-SU-2023_3945-1

OPENSUSE-SU-2024:13416-1

SUSE-SU-2023:3394-1

SUSE-SU-2023:3732-1

SUSE-SU-2023:3791-1

SUSE-SU-2023:3945-1

SUSE-SU-2023_3394-1

SUSE-SU-2023_3732-1

SUSE-SU-2023_3945-1

Produtos afetados

Suse Linux Enterprise Desktop

Suse Linux Enterprise High Performance Computing

Suse

Opensuse Leap

Referências · 22

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32182 · Exploit
• https://twitter.com/CVEnew/status/1704155584574968162 · Publicação no Twitter
• https://osv.dev/vulnerability/SUSE-SU-2023:3732-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-07265 · Nota de Segurança
• https://bugzilla.suse.com/1215372 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2023:3945-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32182 · Nota de Segurança
• https://suse.com/security/cve/CVE-2023-32182 · Nota
• https://bugzilla.suse.com/1211196 · Nota
• https://bugzilla.suse.com/1213515 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:13416-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2023/suse-su-20233791-1 · Nota
• https://t.me/cibsecurity/70739 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2023-32182.html · Nota
• https://osv.dev/vulnerability/SUSE-SU-2023:3394-1 · Aviso do Fabricante