PT-2020-10009 · Suse+1 · Suse Linux Enterprise Server 15+3

Matthias Gerstner · Published 2020-02-26 · Updated 2024-06-15 · CVE-2019-18901

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions mariadb versions prior to 10.2.31-3.25.1 on SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.26.1 on SUSE Linux Enterprise Server 15

Description A UNIX Symbolic Link (Symlink) Following issue in the mysql-systemd-helper of the mariadb packaging allows local attackers to change the permissions of arbitrary files to 0640.

Recommendations For mariadb versions prior to 10.2.31-3.25.1 on SUSE Linux Enterprise Server 12, update to version 10.2.31-3.25.1 or later. For mariadb versions prior to 10.2.31-3.26.1 on SUSE Linux Enterprise Server 15, update to version 10.2.31-3.26.1 or later.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2019-18901

OPENSUSE-SU-2020:0289-1

OPENSUSE-SU-2020_0289-1

OPENSUSE-SU-2024:11038-1

SUSE-RU-2023:3956-1

SUSE-RU-2023:4991-1

SUSE-SU-2020:0496-1

SUSE-SU-2020:0505-1

SUSE-SU-2020:0527-1

SUSE-SU-2020:0640-1

SUSE-SU-2020:0831-1

SUSE-SU-2020_0496-1

SUSE-SU-2020_0505-1

Affected Products

Suse Linux Enterprise Server 12

Suse Linux Enterprise Server 15

Suse

Mariadb

References · 465

• https://osv.dev/vulnerability/SUSE-RU-2023:3956-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18901 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:0496-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11038-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18901 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0527-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0640-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0831-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0505-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0289-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2023:4991-1 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1160895 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-0640 · Note
• https://bugzilla.suse.com/1120041 · Note