Back to bug 2135420
| Who | When | What | Removed | Added |
|---|---|---|---|---|
| Marco Benatto | 2022-10-17 15:26:49 UTC | CC | security-response-team | |
| Marco Benatto | 2022-10-18 14:05:23 UTC | Depends On | 2135826, 2135821, 2135827, 2135828, 2135822, 2135820, 2135824, 2135819, 2135825, 2135823 | |
| Marco Benatto | 2022-10-26 14:20:54 UTC | CC | bootloader-eng-team | |
| Marco Benatto | 2022-10-26 14:28:13 UTC | CC | bootloader-eng-team | |
| Marco Benatto | 2022-10-28 19:15:03 UTC | CC | rharwood | |
| Marco Benatto | 2022-12-14 17:01:04 UTC | Deadline | 2023-01-31 | |
| Marco Benatto | 2023-01-12 15:27:20 UTC | CC | rhughes | |
| Marco Benatto | 2023-01-24 20:59:12 UTC | Depends On | 2164235, 2164236 | |
| Oliver Gutiérrez | 2023-01-27 12:38:29 UTC | CC | ogutierr | |
| Robbie Harwood | 2023-01-27 22:43:39 UTC | Status | NEW | MODIFIED |
| Marco Benatto | 2023-01-31 14:47:31 UTC | Fixed In Version | pesign-116 | |
| Marco Benatto | 2023-01-31 14:52:59 UTC | Doc Text | The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group, however the script doesn't check for symbolic links. An attacker can leverage this flaw to gain access to privileged files and directories via a path traversal attack. | |
| Marco Benatto | 2023-01-31 15:59:52 UTC | Deadline | 2023-01-31 | |
| Summary | EMBARGOED CVE-2022-3560 pesign: Local privilege escalation on pesign systemd service | CVE-2022-3560 pesign: Local privilege escalation on pesign systemd service | ||
| CC | bootloader-eng-team | |||
| Group | qe_staff, security | |||
| Marco Benatto | 2023-01-31 16:00:07 UTC | Depends On | 2165983 | |
| Paige Jung | 2023-01-31 18:58:32 UTC | Doc Text | The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group, however the script doesn't check for symbolic links. An attacker can leverage this flaw to gain access to privileged files and directories via a path traversal attack. | A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack. |
| errata-xmlrpc | 2023-03-06 10:01:03 UTC | Link ID | Red Hat Product Errata RHSA-2023:1065 | |
| errata-xmlrpc | 2023-03-06 10:17:09 UTC | Link ID | Red Hat Product Errata RHSA-2023:1066 | |
| errata-xmlrpc | 2023-03-06 10:43:07 UTC | Link ID | Red Hat Product Errata RHSA-2023:1067 | |
| errata-xmlrpc | 2023-03-07 09:54:19 UTC | Link ID | Red Hat Product Errata RHSA-2023:1093 | |
| errata-xmlrpc | 2023-03-07 13:16:09 UTC | Link ID | Red Hat Product Errata RHSA-2023:1107 | |
| errata-xmlrpc | 2023-04-04 09:07:20 UTC | Link ID | Red Hat Product Errata RHSA-2023:1586 | |
| errata-xmlrpc | 2023-04-04 09:45:47 UTC | Link ID | Red Hat Product Errata RHSA-2023:1572 | |
| errata-xmlrpc | 2023-04-18 16:33:04 UTC | Link ID | Red Hat Product Errata RHSA-2023:1829 | |
| Product Security DevOps Team | 2023-04-18 22:05:02 UTC | Resolution | --- | ERRATA |
| Status | MODIFIED | CLOSED | ||
| Last Closed | 2023-04-18 22:05:02 UTC |
Back to bug 2135420