CVE-2019-3690 chkstat follows untrusted symbolic links

What is CVE-2019-3690?

CVE-2019-3690 is a medium-severity path traversal vulnerability in Opensuse Leap, published on 5 Dec 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.

Weakness: CWE-59

Which versions are affected by CVE-2019-3690?

It affects 1 product.

Products include Opensuse Leap.

How do I fix CVE-2019-3690?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-3690 being exploited?

There is no known exploitation of CVE-2019-3690 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Leap

• CVE-2015-4902 Oracle Java SE Integrity Check Exploited Medium 5.3
• CVE-2017-14804 package builds could use directory traversal to write outside of target area Critical 9.9
• CVE-2019-20787 Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size. Critical 9.8
• CVE-2019-8341 Code injection in n/a Critical 9.8
• CVE-2019-6438 Other in n/a Critical 9.8

All Opensuse Leap vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jxhx-2gqw-c77x, SUSE-SU-2019:14237-1.