CVE-2023-32182 Path traversal in SUSE Linux Enterprise Desktop 15 SP5
An attacker can exploit improper link resolution in Postfix to access or modify files outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32182?
CVE-2023-32182 is a medium-severity path traversal vulnerability in Opensuse Leap, published on 19 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.
Weakness: CWE-59
Which versions are affected by CVE-2023-32182?
It affects 3 products.
Linux distribution packages (17)
postfix SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 3.5.9-150300.5.12.2 |
postfix SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 3.7.3-150500.3.5.1 |
postfix-bdb SUSE:Linux Enterprise Module for Legacy 15 SP4 | All versions | 3.5.9-150300.5.12.2 |
postfix-bdb SUSE:Linux Enterprise Module for Legacy 15 SP5 | All versions | 3.7.3-150500.3.5.1 |
postfix SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 3.5.9-150300.5.12.2 |
postfix SUSE:Linux Enterprise Module for Server Applications 15 SP5 | All versions | 3.7.3-150500.3.5.1 |
postfix SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.2.10-3.27.2 |
postfix SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.2.10-3.27.2 |
postfix SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.2.10-3.27.2 |
postfix SUSE:Manager Proxy 4.2 | All versions | 3.5.9-150300.5.12.2 |
postfix SUSE:Manager Server 4.2 | All versions | 3.5.9-150300.5.12.2 |
postfix openSUSE:Leap 15.4 | All versions | 3.4.7-150200.3.12.2 |
postfix openSUSE:Leap 15.4 | All versions | 3.5.9-150300.5.12.2 |
postfix-bdb openSUSE:Leap 15.4 | All versions | 3.5.9-150300.5.12.2 |
postfix openSUSE:Leap 15.5 | All versions | 3.7.3-150500.3.5.1 |
postfix-bdb openSUSE:Leap 15.5 | All versions | 3.7.3-150500.3.5.1 |
postfix openSUSE:Tumbleweed | All versions | 3.8.3-1.1 |
Products include Opensuse Leap, Suse Linux Enterprise High Performance Computing, Suse Suse Linux Enterprise Desktop.
How do I fix CVE-2023-32182?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-32182 being exploited?
There is no known exploitation of CVE-2023-32182 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
Sources
Also known as GHSA-wcv5-982f-xggc, SUSE-SU-2023:3394-1, SUSE-SU-2023:3732-1, SUSE-SU-2023:3791-1, SUSE-SU-2023:3945-1, openSUSE-SU-2024:13416-1.