CVE-2022-21945 cscreen: usage of fixed path /tmp/cscreen.debug
Local attackers can cause denial of service in cscreen and potentially the system by exploiting an insecure temporary file path.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21945?
CVE-2022-21945 is a medium-severity path traversal vulnerability in openSUSE Factory, published on 16 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.
Weakness: CWE-377
Which versions are affected by CVE-2022-21945?
It affects 1 product.
Products include Opensuse Cscreen.
How do I fix CVE-2022-21945?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-21945 being exploited?
There is no known exploitation of CVE-2022-21945 in the wild and no public exploit code.
Other vulnerabilities in openSUSE Factory
Sources
Also known as GHSA-xxwq-xf8c-v665.