Vulnerability in Fedoraproject Fedora
CVE-2021-25317
A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.
EPSS: 0.003 (18.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Fedoraproject Fedora — versions 32, 33, 34
- Opensuse Factory — versions cups
- Opensuse Leap — versions 15.2
- Opensuse Leap 15.2 — versions cups
- Suse Cups
- Suse Linux_enterprise_server — versions 11
- Suse Manager_server — versions 4.0
- Suse Openstack_cloud_crowbar — versions 9.0
- Suse Linux Enterprise Server 11-sp4-ltss — versions cups
- Suse Manager Server 4.0 — versions cups
Weakness classification (CWE)
References
- meissner@suse.de (Issue Tracking, Vendor Advisory)
- meissner@suse.de (vendor-advisory)
- meissner@suse.de (vendor-advisory)
- meissner@suse.de (vendor-advisory)
Frequently asked questions
- What is CVE-2021-25317?
- CVE-2021-25317 is a low-severity vulnerability in Fedoraproject Fedora, classified under Incorrect Default Permissions. CVSS score: 3.3/10. Published 2021-05-05.
- How severe is CVE-2021-25317?
- Low severity. CVSS v3 base score is 3.3 out of 10.