PT-2020-19927 · Suse · Suse Linux Enterprise Server 15+5

Matthias Gerstner · Published 2020-08-07 · Updated 2022-05-27 · CVE-2020-8025

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1 SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1 SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1 openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1 openSUSE Tumbleweed permissions versions prior to 20200624

Description A vulnerability in the permissions package of the affected systems sets the permissions for some of the directories of the pcp package to unintended settings. This issue is related to Incorrect Execution-Assigned Permissions.

Recommendations For SUSE Linux Enterprise Server 12-SP4, update the permissions package to version 20170707-3.24.1 or later. For SUSE Linux Enterprise Server 15-LTSS, update the permissions package to version 20180125-3.27.1 or later. For SUSE Linux Enterprise Server for SAP 15, update the permissions package to version 20180125-3.27.1 or later. For openSUSE Leap 15.1, update the permissions package to version 20181116-lp151.4.24.1 or later. For openSUSE Tumbleweed, update the permissions package to version 20200624 or later.

Exploit

Fix

Weakness Enumeration

CWE-279

Related Identifiers

CVE-2020-8025

OPENSUSE-SU-2022_1509-1

SUSE-SU-2021:0197-1

SUSE-SU-2021:1292-1

SUSE-SU-2021_0197-1

SUSE-SU-2022:1509-1

SUSE-SU-2022:1873-1

SUSE-SU-2022_1873-1

Affected Products

Suse Linux Enterprise Server 12-Sp4

Suse Linux Enterprise Server 15

Suse Linux Enterprise Server For Sap 15

Suse

Opensuse Leap 15.1

Opensuse Tumbleweed

References · 15

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1171883 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2022:1873-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1509-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8025 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8025 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1292-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0197-1 · Vendor Advisory
• https://suse.com/support/update/announcement/2021/suse-su-20211292-1 · Note
• https://suse.com/security/cve/CVE-2020-8025 · Note
• https://bugzilla.suse.com/1181571 · Note
• https://bugzilla.suse.com/1171883 · Note
• https://suse.com/support/update/announcement/2022/suse-su-20221509-1 · Note
• https://suse.com/support/update/announcement/2021/suse-su-20210197-1 · Note
• https://suse.com/support/update/announcement/2022/suse-su-20221873-1 · Note
• https://bugzilla.suse.com/1123311 · Note