PT-2023-6518 · Opensuse+1 · Opensuse Leap+3

Matthias Gerstner · Published 2023-08-23 · Updated 2024-06-15 · CVE-2023-32182

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions postfix versions prior to 3.7.3-150500.3.5.1 in SUSE Linux Enterprise Desktop 15 SP5 postfix versions prior to 3.7.3-150500.3.5.1 in SUSE Linux Enterprise High Performance Computing 15 SP5 postfix versions prior to 3.7.3-150500.3.5.1 in openSUSE Leap 15.5

Description The issue is related to an Improper Link Resolution Before File Access ('Link Following') vulnerability in the postfix package of certain SUSE and openSUSE operating systems. This vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For SUSE Linux Enterprise Desktop 15 SP5, update postfix to version 3.7.3-150500.3.5.1 or later. For SUSE Linux Enterprise High Performance Computing 15 SP5, update postfix to version 3.7.3-150500.3.5.1 or later. For openSUSE Leap 15.5, update postfix to version 3.7.3-150500.3.5.1 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2023-07265

CVE-2023-32182

OPENSUSE-SU-2023_3394-1

OPENSUSE-SU-2023_3791-1

OPENSUSE-SU-2023_3945-1

OPENSUSE-SU-2024:13416-1

SUSE-SU-2023:3394-1

SUSE-SU-2023:3732-1

SUSE-SU-2023:3791-1

SUSE-SU-2023:3945-1

SUSE-SU-2023_3394-1

SUSE-SU-2023_3732-1

SUSE-SU-2023_3945-1

Affected Products

Suse Linux Enterprise Desktop

Suse Linux Enterprise High Performance Computing

Suse

Opensuse Leap

References · 22

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32182 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2023:3732-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07265 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:3945-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32182 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13416-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3394-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3791-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32182 · Vendor Advisory
• https://twitter.com/CVEnew/status/1704155584574968162 · Twitter Post
• https://bugzilla.suse.com/1215372 · Note
• https://suse.com/security/cve/CVE-2023-32182 · Note
• https://bugzilla.suse.com/1211196 · Note
• https://bugzilla.suse.com/1213515 · Note
• https://suse.com/support/update/announcement/2023/suse-su-20233791-1 · Note