CVE-2019-18899 apt-cacher-ng insecure use of /run/apt-cacher-ng

Medium 6.2 Published 23 Jan 2020 Updated 17 Sep 2024

Local attackers can escalate privileges by exploiting root operations in a user-owned directory within the apt-cacher-ng package on openSUSE Leap.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2019-18899?

CVE-2019-18899 is a medium-severity vulnerability in Opensuse Backports, published on 23 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1.

Weakness: CWE-269

Which versions are affected by CVE-2019-18899?

It affects 2 products.

Products include Apt-Cacher-Ng Project Apt-Cacher-Ng, Opensuse Backports.

How do I fix CVE-2019-18899?

Apply the vendor's patch.

Is CVE-2019-18899 being exploited?

There is no known exploitation of CVE-2019-18899 in the wild and no public exploit code.

All Opensuse Backports vulnerabilities

Sources

Also known as GHSA-fv3j-23hh-g3xf.