https://bugzilla.redhat.com/show_bug.cgi?id=1852863
Bug ID: 1852863
Summary: CVE-2020-8022 tomcat: /usr/lib/tmpfiles.d/tomcat.conf
is group-writable
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bgeorges(a)redhat.com,
bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, huwang(a)redhat.com, ibek(a)redhat.com,
ikanello(a)redhat.com, ivan.afonichev(a)gmail.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, mbabacek(a)redhat.com,
mburns(a)redhat.com, mizdebsk(a)redhat.com,
mkolesni(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
rguimara(a)redhat.com, rhcs-maint(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com,
weli(a)redhat.com
Target Milestone: ---
Classification: Other
A Incorrect Default Permissions vulnerability in the packaging of tomcat on
SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux
Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE
Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE
Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE
Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP
12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE
OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to
escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage
5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server
12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise
Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux
Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE
Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1.
SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1.
SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1.
SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3.
SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to
8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions
prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat
versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior
to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to
8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to
8.0.53-29.32.1.
Reference:
https://bugzilla.suse.com/show_bug.cgi?id=1172405
--
You are receiving this mail because:
You are on the CC list for the bug.