PT-2019-12995 · Alpine Linux · Alpine Linux

Published 2019-06-18 · Updated 2020-08-24 · CVE-2019-12875

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Alpine Linux abuild versions prior to 3.4.1

Description The issue allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option, causing acceptance of an untrusted signing key.

Recommendations For versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue.

Fix

Missing Authorization

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-862

CWE-668

Related Identifiers

CVE-2019-12875

Affected Products

Alpine Linux

References · 5

• https://code.foxkit.us/adelie/packages/commit/15b160780c6eeff7048063c099a7f8757e1d8391 · Patch
• ❌ https://github.com/sroracle/abuild/commit/4f90ce92778d0ee302e288def75591b96a397c8b · Patch, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2019-12875 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12875 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190625-0005 · Note