CVE-2021-28129 DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid

High 7.8 Published 7 Oct 2021 Updated 3 Aug 2024

Apache OpenOffice DEB packages installed with incorrect user permissions, potentially allowing attackers to modify files owned by that user.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-28129?

CVE-2021-28129 is a high-severity vulnerability in Apache Openoffice, published on 7 Oct 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. Users who installed the Apache OpenOffice 4.1.8 DEB packaging should upgrade to the latest version of Apache OpenOffice.

Weakness: CWE-284

Which versions are affected by CVE-2021-28129?

It affects 1 product.

Products include Apache Openoffice.

How do I fix CVE-2021-28129?

No fix has been published for CVE-2021-28129 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-28129 being exploited?

There is no known exploitation of CVE-2021-28129 in the wild and no public exploit code.

All Apache Openoffice vulnerabilities

Sources

Also known as GHSA-67cj-mh2q-5g8c.