MEDIUM
snapcraft may build snaps with incorrect LD_LIBRARY_PATH
Published Dec 4, 2020
6.8
MEDIUMCVSS 3.1
EPSS 0.70%
Description
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
Affected products
-
- Version 2.43.1StatusaffectedConstraints<2.43.1+16.04.1
- Version 4.4StatusaffectedConstraints<4.4.4
- Version
Configuration 2
OR
- 16.04
- 18.04
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (8)
- https://bugs.launchpad.net/bugs/1901572 x_refsource_MISCExploitIssue TrackingThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0181 Advisory
- https://github.com/advisories/GHSA-qxm5-vx5j-pp6w Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/snapcraft/PYSEC-2020-109.yaml
- https://github.com/snapcore/snapcraft/commit/a0ceca9d531a34c979251030ed67b5fa2abfdd9a
- https://github.com/snapcore/snapcraft/pull/3345 x_refsource_MISCThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-27348
- https://usn.ubuntu.com/usn/usn-4661-1 x_refsource_MISCPatchThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://bugs.launchpad.net/bugs/1901572 | x_refsource_MISCExploitIssue TrackingThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0181 | Advisory | |
| https://github.com/advisories/GHSA-qxm5-vx5j-pp6w | Advisory | |
| https://github.com/pypa/advisory-database/tree/main/vulns/snapcraft/PYSEC-2020-109.yaml | ||
| https://github.com/snapcore/snapcraft/commit/a0ceca9d531a34c979251030ed67b5fa2abfdd9a | ||
| https://github.com/snapcore/snapcraft/pull/3345 | x_refsource_MISCThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-27348 | ||
| https://usn.ubuntu.com/usn/usn-4661-1 | x_refsource_MISCPatchThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner canonical
Published Dec 4, 2020
Updated Sep 16, 2024
Reserved Oct 20, 2020
Link CVE-2020-27348
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2020-0181 GHSA-QXM5-VX5J-PP6W Assigner canonical
Published Dec 4, 2020
Updated Sep 16, 2024
Exploited since n/a
Link EUVD-2020-0181