PT-2019-5774 · Debian · Sympa

Sylvain Beucler · Published 2019-01-08 · Updated 2022-11-08 · CVE-2020-26932

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Debian Sympa package versions prior to 6.2.40~dfsg-7

Description The issue is related to the debian/sympa.postinst component of the Sympa package, which sets incorrect permissions for the sympa newaliases-wrapper. This could allow a remote attacker to impact data integrity. The intended permissions are mode 4750, which allows access by the sympa group, but the current setting is mode 4755.

Recommendations For versions prior to 6.2.40dfsg-7, update to version 6.2.40dfsg-7 or later to resolve the issue. As a temporary workaround, consider changing the permissions of sympa newaliases-wrapper to mode 4750 to restrict access to the sympa group.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2021-01769

CVE-2020-26932

DLA-2401-1

DSA-4818-1

Affected Products

Sympa

References · 30

• https://osv.dev/vulnerability/DSA-4818-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/sympa · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26932 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26932 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10936 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-26932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26932 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29668 · Security Note
• https://security-tracker.debian.org/tracker/DSA-4818-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26932 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9369 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26932 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-2401-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26880 · Security Note
• https://osv.dev/vulnerability/DLA-2401-1 · Vendor Advisory