PT-2023-22268 · Sagemath+1 · Sagemath Flintqs+1

Orlitzky · Published 2023-04-06 · Updated 2023-04-13 · CVE-2023-29465

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SageMath FlintQS version 1.0

Description The issue allows a local user to overwrite files with the privileges of a different user who is running SageMath FlintQS, due to its reliance on pathnames under TMPDIR, which is typically world-writable.

Recommendations For SageMath FlintQS version 1.0, consider restricting access to the TMPDIR to prevent unauthorized file overwrites until a patch is available. As a temporary workaround, restrict write access to the TMPDIR directory to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-29465

Affected Products

Debian

Sagemath Flintqs

References · 14

• 🔥 https://github.com/sagemath/FlintQS/issues/3 · Exploit
• https://github.com/sagemath/sage/pull/35419 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29465 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-29465 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29465 · Security Note
• https://security-tracker.debian.org/tracker/source-package/flintqs · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29465 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29465 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29465 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29465 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-29465 · Security Note
• https://t.me/cibsecurity/61610 · Telegram Post
• https://t.me/cvenotify/47733 · Telegram Post
• https://packages.debian.org/src:flintqs · Note