PT-2020-10912 · Suse+1 · Suse Linux Enterprise Server+3

Johannes Segitz · Published 2019-11-25 · Updated 2022-11-10 · CVE-2019-3693

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1 SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1 openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions

Description A symlink following issue in the packaging of mailman allowed local attackers to escalate their privileges from user wwwrun to root. Additionally, arbitrary files could be changed to group mailman.

Recommendations For SUSE Linux Enterprise Server 11, update mailman to version 2.1.15-9.6.15.1 or later. For SUSE Linux Enterprise Server 12, update mailman to version 2.1.17-3.11.1 or later. For openSUSE Leap 15.1, update mailman to a version later than 2.1.29-lp151.2.14.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2019-3693

OPENSUSE-SU-2020:0148-1

OPENSUSE-SU-2020:0156-1

OPENSUSE-SU-2020_0148-1

SUSE-SU-2019:14230-1

SUSE-SU-2019:3076-1

SUSE-SU-2019_14230-1

SUSE-SU-2019_3076-1

Affected Products

Suse Linux Enterprise Server

Suse

Mailman

Opensuse Leap

References · 15

• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3693 · Security Note
• https://bugzilla.suse.com/show_bug.cgi?id=1154328 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0148-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0156-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14230-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3693 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3076-1 · Vendor Advisory
• https://suse.com/support/update/announcement/2019/suse-su-20193076-1 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/JZBF7GOXNJX7FAHTZ25MQVPYYL5S3MAW · Note
• https://suse.com/security/cve/CVE-2019-3693 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/RMGU7U75MH52MOBH2ERROW6BFVQWCEJD · Note
• https://suse.com/support/update/announcement/2019/suse-su-201914230-1 · Note
• https://bugzilla.suse.com/1154328 · Note