SNOW-619476: util-linuxv2.36.2: 2 vulnerabilities (highest severity is: 5.5) - autoclosed
Closed this issue · 1 comments
Vulnerable Library - util-linuxv2.36.2
The util-linux code repository.
Library home page: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
Vulnerable Source Files (2)
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2022-0563 |  Medium |
5.5 | util-linuxv2.36.2 | Direct | v2.37.4 | ❌ |
| CVE-2021-3995 | Medium |
4.7 | util-linuxv2.36.2 | Direct | v2.37.3 | ❌ |
Details
CVE-2022-0563
Vulnerable Library - util-linuxv2.36.2
The util-linux code repository.
Library home page: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
Found in base branch: master
Vulnerable Source Files (2)
Vulnerability Details
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
Publish Date: 2022-02-21
URL: CVE-2022-0563
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=2053151
Release Date: 2022-02-21
Fix Resolution: v2.37.4
CVE-2021-3995
Vulnerable Library - util-linuxv2.36.2
The util-linux code repository.
Library home page: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
Found in base branch: master
Vulnerable Source Files (1)
Vulnerability Details
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
Publish Date: 2021-11-22
URL: CVE-2021-3995
CVSS 3 Score Details (4.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security-tracker.debian.org/tracker/CVE-2021-3995
Release Date: 2021-11-22
Fix Resolution: v2.37.3
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.