PT-2020-19918 · Opensuse+1 · Opensuse Tumbleweed+2

Johannes Segitz · Published 2020-06-29 · Updated 2020-07-09 · CVE-2020-8014

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openSUSE Leap 15.1 kopano-spamd versions prior to 10.0.5-lp151.4.1 openSUSE Tumbleweed kopano-spamd versions prior to 10.0.5-1.1

Description A UNIX Symbolic Link (Symlink) Following issue in the packaging of kopano-spamd allows local attackers with the privileges of the kopano user to escalate to root.

Recommendations For openSUSE Leap 15.1 kopano-spamd versions prior to 10.0.5-lp151.4.1, update to version 10.0.5-lp151.4.1 or later. For openSUSE Tumbleweed kopano-spamd versions prior to 10.0.5-1.1, update to version 10.0.5-1.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2020-8014

Affected Products

Kopano-Spamd

Opensuse Leap 15.1

Opensuse Tumbleweed

References · 4

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1164131 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-8014 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8014 · Vendor Advisory
• https://t.me/cvenotify/4696 · Telegram Post