PT-2020-16674 · Canonical · Snapcraft+1

Itszn + 2 · Published 2020-12-03 · Updated 2022-05-24 · CVE-2020-27348

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions snapcraft versions prior to 4.4.4 snapcraft versions prior to 2.43.1+16.04.1 snapcraft versions prior to 2.43.1+18.04.1

Description In some conditions, a snap package built by snapcraft includes the current directory in LD LIBRARY PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar.

Recommendations For versions prior to 4.4.4, update to version 4.4.4 or later. For versions prior to 2.43.1+16.04.1, update to version 2.43.1+16.04.1 or later. For versions prior to 2.43.1+18.04.1, update to version 2.43.1+18.04.1 or later. As a temporary workaround, consider restricting the use of the LD LIBRARY PATH variable to minimize the risk of exploitation.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-27348

GHSA-QXM5-VX5J-PP6W

PYSEC-2020-109

USN-4661-1

Affected Products

Ubuntu

Snapcraft

References · 20

• 🔥 https://bugs.launchpad.net/bugs/1901572 · Exploit
• https://usn.ubuntu.com/usn/usn-4661-1 · Patch
• https://ubuntu.com/security/notices/USN-4661-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qxm5-vx5j-pp6w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27348 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-27348 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-109 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27348 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27348 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4661-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-27348 · Vendor Advisory
• https://github.com/snapcore/snapcraft/pull/3345 · Note
• https://github.com/snapcore/snapcraft · Note
• https://github.com/snapcore/snapcraft/commit/a0ceca9d531a34c979251030ed67b5fa2abfdd9a · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/snapcraft/PYSEC-2020-109.yaml · Note