PT-2020-19928 · Isi+1 · Inn+1

Matthias Gerstner · Published 2020-08-07 · Updated 2023-01-24 · CVE-2020-8026

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions inn versions 2.6.2-lp152.1.26 and prior versions inn versions 2.6.2-4.2 and prior versions inn versions 2.5.4-lp151.3.3.1 and prior versions

Description A vulnerability in the packaging of inn in openSUSE allows local attackers with control of a new user to escalate their privileges to root.

Recommendations For inn version 2.6.2-lp152.1.26 and prior versions, update to a version later than 2.6.2-lp152.1.26 to resolve the issue. For inn version 2.6.2-4.2 and prior versions, update to a version later than 2.6.2-4.2 to resolve the issue. For inn version 2.5.4-lp151.3.3.1 and prior versions, update to a version later than 2.5.4-lp151.3.3.1 to resolve the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-8026

OPENSUSE-SU-2020:1271-1

OPENSUSE-SU-2020:1272-1

OPENSUSE-SU-2020:1304-1

OPENSUSE-SU-2020:1427-1

OPENSUSE-SU-2020_1271-1

OPENSUSE-SU-2020_1272-1

Affected Products

Suse

Inn

References · 17

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00038.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00064.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00074.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1427-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8026 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1272-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8026 · Security Note
• https://bugzilla.suse.com/show_bug.cgi?id=1172573 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00063.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1304-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1271-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-8026 · Note
• https://bugzilla.suse.com/1172573 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NDORVRMXBO7ASM264AYFHMD3OH4O6LJY · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/5AHQWOZSB3POCF7B7QNSKINNAC7DUZXD · Note