A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.
References
| Link | Resource |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html | Broken Link Mailing List Vendor Advisory |
| https://bugzilla.suse.com/show_bug.cgi?id=1157465 | Issue Tracking Vendor Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html | Broken Link Mailing List Vendor Advisory |
| https://bugzilla.suse.com/show_bug.cgi?id=1157465 | Issue Tracking Vendor Advisory |
Configurations
History
21 Nov 2024, 04:33
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 8.4 |
| References | () http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html - Broken Link, Mailing List, Vendor Advisory | |
| References | () https://bugzilla.suse.com/show_bug.cgi?id=1157465 - Issue Tracking, Vendor Advisory |
Information
Published : 2020-03-02 16:15
Updated : 2024-11-21 04:33
NVD link : CVE-2019-18897
Mitre link : CVE-2019-18897
CVE.ORG link : CVE-2019-18897
JSON object : View
Products Affected
suse
- linux_enterprise_server
opensuse
- leap
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')