CVE-2021-32556 apport get_modified_conffiles() function command injection

What is CVE-2021-32556?

CVE-2021-32556 is a low-severity command injection vulnerability in Canonical apport, published on 12 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.

Weakness: CWE-78

Which versions are affected by CVE-2021-32556?

It affects 1 product.

Products include Canonical Apport.

How do I fix CVE-2021-32556?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-32556 being exploited?

There is no known exploitation of CVE-2021-32556 in the wild and no public exploit code.

Other vulnerabilities in Canonical apport

• CVE-2021-25682 apport improperly parses /proc/pid/status High 8.8
• CVE-2021-25683 apport improperly parses /proc/pid/stat High 8.8
• CVE-2021-25684 apport can be stalled by reading a FIFO High 8.8
• CVE-2021-3899 Race condition in Apport High 7.8
• CVE-2022-1242 Other in Apport High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6hq6-w9x9-j77g, UBUNTU-CVE-2021-32556.