CVE-2020-8019

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SUSE Linux Enterprise Debuginfo 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Debuginfo 11-SP4 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Module for Legacy Software 12 syslog-ng versions prior to 3.6.4-12.8.1. SUSE Linux Enterprise Point of Sale 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server 11-SP4-LTSS syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server for SAP 12-SP1 syslog-ng versions prior to 3.6.4-12.8.1. openSUSE Backports SLE-15-SP1 syslog-ng versions prior to 3.19.1-bp151.4.6.1. openSUSE Leap 15.1 syslog-ng versions prior to 3.19.1-lp151.3.6.1.
References
Link Resource
https://bugzilla.suse.com/show_bug.cgi?id=1169385 Exploit Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_module_for_legacy:12:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_point_of_sale:11:sp3:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:sap:*:*

Configuration 7 (hide)

AND
cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-06-29 12:15

Updated : 2024-02-04 21:00


NVD link : CVE-2020-8019

Mitre link : CVE-2020-8019

CVE.ORG link : CVE-2020-8019


JSON object : View

Products Affected

suse

  • linux_enterprise_point_of_sale
  • linux_enterprise_debuginfo
  • linux_enterprise_server
  • linux_enterprise_module_for_legacy

oneidentity

  • syslog-ng

opensuse

  • backports_sle
  • leap
CWE
CWE-61

UNIX Symbolic Link (Symlink) Following