PT-2022-17033 · Kde+2 · Kde Kcron+2

Carlos López · Published 2022-02-26 · Updated 2023-10-12 · CVE-2022-24986

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KDE KCron versions prior to 21.12.3

Description The issue allows an attacker to potentially intercept a temporary file and run unauthorized commands. This is due to the reuse of a filename in the /tmp directory during an editing session.

Recommendations For versions prior to 21.12.3, update to version 21.12.3 or later to resolve the issue.

Fix

Race Condition

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-362

CWE-668

Related Identifiers

ALT-PU-2022-1439

ALT-PU-2022-1586

CVE-2022-24986

OPENSUSE-SU-2024:11881-1

Affected Products

Alt Linux

Debian

Kde Kcron

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24986 · Security Note
• https://ubuntu.com/security/CVE-2022-24986 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24986 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24986 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24986 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24986 · Vendor Advisory
• https://invent.kde.org/system/kcron/-/merge_requests/14 · Note
• https://kde.org/info/security/advisory-20220216-1.txt · Note
• https://apps.kde.org/kcron · Note
• https://twitter.com/ghosted_sound/status/1712590391785259285 · Twitter Post
• https://invent.kde.org/system/kcron/-/commit/ef4266e3d5ea741c4d4f442a2cb12a317d7502a1 · Note
• https://openwall.com/lists/oss-security/2022/02/25/3 · Note
• http://openwall.com/lists/oss-security/2022/02/25/3 · Note