CVE-2020-12831 Information disclosure in n/a
An attacker can read sensitive configuration data because the init script creates world-readable files when the split-config feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12831?
CVE-2020-12831 is a medium-severity vulnerability in n/a, published on 13 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file
Weakness: CWE-732
Which versions are affected by CVE-2020-12831?
It affects 1 product.
Linux distribution packages (6)
frr-contrib AlmaLinux:8 | All versions | 7.0-10.el8 |
frr Red Hat:enterprise_linux:8::appstream | All versions | 0:7.0-10.el8 |
frr-contrib Red Hat:enterprise_linux:8::appstream | All versions | 0:7.0-10.el8 |
frr-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:7.0-10.el8 |
frr-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:7.0-10.el8 |
frr openSUSE:Tumbleweed | All versions | 7.5.1-3.1 |
Products include Linuxfoundation Free Range Routing.
How do I fix CVE-2020-12831?
Apply the vendor's patch.
Is CVE-2020-12831 being exploited?
There is no known exploitation of CVE-2020-12831 in the wild and no public exploit code.
Sources
Also known as ALSA-2020:4619, DEBIAN-CVE-2020-12831, GHSA-x83m-q23q-xv5j, RHSA-2020:4619, openSUSE-SU-2024:10583-1.