CVE-2020-8026 inn: non-root owned files

What is CVE-2020-8026?

CVE-2020-8026 is a high-severity vulnerability in Opensuse Backports Sle, published on 7 Aug 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.

Weakness: CWE-276

Which versions are affected by CVE-2020-8026?

It affects 3 products.

Products include Opensuse Backports Sle, Opensuse Leap, Opensuse Tumbleweed.

How do I fix CVE-2020-8026?

Apply the vendor's patch.

Is CVE-2020-8026 being exploited?

There is no known exploitation of CVE-2020-8026 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Backports Sle

• CVE-2020-12641 Roundcube Webmail Remote Code Execution Exploited Critical 9.8
• CVE-2020-12640 Path traversal in n/a Critical 9.8
• CVE-2020-8233 Command injection in EdgeSwitch firmware v1.9.0 and prior High 8.8
• CVE-2020-15229 Path traversal and files overwrite with unsquashfs High 8.2
• CVE-2019-5164 Command injection in Shadowsocks High 7.8

All Opensuse Backports Sle vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fm9w-35mc-phwx, openSUSE-SU-2020:1271-1, openSUSE-SU-2020:1272-1, openSUSE-SU-2020:1304-1, openSUSE-SU-2020:1427-1.