CVE-2022-3560 - pesign: Local privilege escalation on pesign systemd service

Back Back to CVE browser

HIGH

pesign: Local privilege escalation on pesign systemd service

Published Feb 2, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.25%

Description

A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.

Affected products

Vendor n/a Product Pesign Default
n/a
- Version
  All versions up to pesign-115
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Pesign

n/a

Version	Status	Constraints
All versions up to pesign-115	affected	-

Red Hat Enterprise Linux 7

pesign-0:0.109-11.el7_9

Fixed · RHSA-2023:1093
Red Hat Enterprise Linux 8

pesign-0:0.112-27.el8_7

Fixed · RHSA-2023:1572
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

pesign-0:0.112-25.el8_1.1

Fixed · RHSA-2023:1586
Red Hat Enterprise Linux 8.2 Advanced Update Support

pesign-0:0.112-25.el8_2.1

Fixed · RHSA-2023:1107
Red Hat Enterprise Linux 8.2 Telecommunications Update Service

pesign-0:0.112-25.el8_2.1

Fixed · RHSA-2023:1107
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

pesign-0:0.112-25.el8_2.1

Fixed · RHSA-2023:1107
Red Hat Enterprise Linux 8.4 Extended Update Support

pesign-0:0.112-25.el8_4.1

Fixed · RHSA-2023:1066
Red Hat Enterprise Linux 8.6 Extended Update Support

pesign-0:0.112-27.el8_6

Fixed · RHSA-2023:1829
Red Hat Enterprise Linux 9

pesign-0:115-6.el9_1

Fixed · RHSA-2023:1067
Red Hat Enterprise Linux 9.0 Extended Update Support

pesign-0:115-6.el9_0

Fixed · RHSA-2023:1065

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	pesign-0:0.109-11.el7_9	Fixed	RHSA-2023:1093
Red Hat Enterprise Linux 8	pesign-0:0.112-27.el8_7	Fixed	RHSA-2023:1572
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	pesign-0:0.112-25.el8_1.1	Fixed	RHSA-2023:1586
Red Hat Enterprise Linux 8.2 Advanced Update Support	pesign-0:0.112-25.el8_2.1	Fixed	RHSA-2023:1107
Red Hat Enterprise Linux 8.2 Telecommunications Update Service	pesign-0:0.112-25.el8_2.1	Fixed	RHSA-2023:1107
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	pesign-0:0.112-25.el8_2.1	Fixed	RHSA-2023:1107
Red Hat Enterprise Linux 8.4 Extended Update Support	pesign-0:0.112-25.el8_4.1	Fixed	RHSA-2023:1066
Red Hat Enterprise Linux 8.6 Extended Update Support	pesign-0:0.112-27.el8_6	Fixed	RHSA-2023:1829
Red Hat Enterprise Linux 9	pesign-0:115-6.el9_1	Fixed	RHSA-2023:1067
Red Hat Enterprise Linux 9.0 Extended Update Support	pesign-0:115-6.el9_0	Fixed	RHSA-2023:1065

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (6)

https://access.redhat.com/security/cve/CVE-2022-3560
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2135420
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0
Issue TrackingThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42926
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3560
https://www.cve.org/CVERecord?id=CVE-2022-3560

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-3560		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2135420		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0		Issue TrackingThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42926		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3560
https://www.cve.org/CVERecord?id=CVE-2022-3560