CVE-2022-2787

EPSS 0.09%
Published 27.08.2022 12:15:08
Last modified 21.11.2024 07:01:41
Source security@debian.org
Teams watchlist Login
Open Login

Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.

Affected products Warnungen 0 Metrics 2 CWE 1 References 7

Data is provided by the National Vulnerability Database (NVD)

Debian ≫ Schroot Version < 1.6.13

Debian ≫ Debian Linux Version10.0

Debian ≫ Debian Linux Version11.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.09%	0.271

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d

Patch

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html

Vendor Advisory

Mailing List

https://lists.debian.org/debian-security-announce/2022/msg00182.html

Vendor Advisory

Mailing List

https://security.gentoo.org/glsa/202210-11

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-2787

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-2787

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-2787

EUVD