PT-2022-9150 · Debian · Debian-Edu-Config

Dustin Hermann + 3 · Published 2022-02-11 · Updated 2022-02-22 · CVE-2021-20001

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions debian-edu-config versions prior to 2.12.16

Description It was discovered that debian-edu-config, a set of configuration files used for the Debian Edu blend, configured insecure permissions for the user web shares (~/public html), which could result in privilege escalation.

Recommendations For versions prior to 2.12.16, update to version 2.12.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the user web shares (~/public html) until the update is applied.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-20001

DLA-2918-1

DSA-5072-1

Affected Products

Debian-Edu-Config

References · 15

• https://debian.org/security/2022/dsa-5072 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-20001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20001 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20001 · Vendor Advisory
• https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/4d39a5888d193567704238f8c035f8d17cfe34e5 · Patch
• https://osv.dev/vulnerability/DSA-5072-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2918-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20001 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/02/msg00012.html · Note
• https://lists.debian.org/debian-security-announce/2022/msg00039.html · Note
• https://t.me/cibsecurity/37350 · Telegram Post
• https://t.me/cvenotify/26711 · Telegram Post
• https://t.me/cvenotify/27170 · Telegram Post
• https://t.me/cvenotify/26744 · Telegram Post
• https://t.me/cvenotify/26698 · Telegram Post