4.3

CVE-2022-2787

stricter rules on chroot names

Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Schroot Version < 1.6.13
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.82% 0.525
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html
Vendor Advisory
Mailing List
https://lists.debian.org/debian-security-announce/2022/msg00182.html
Vendor Advisory
Mailing List
https://security.gentoo.org/glsa/202210-11
Third Party Advisory