Bug 1787080 (CVE-2019-18898)

Summary:	CVE-2019-18898 trousers: local privilege escalation from tss to root
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	avagarwa, gblomqui, jsnitsel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-12-30 21:08:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1787081

Description Guilherme de Almeida Suckevicz 2019-12-30 20:39:21 UTC

Fixed a local symlink attack where a rogue tss user could have gain ownership of arbitrary files in the system during installation/update of the trousers package.

Reference:
https://www.tenable.com/plugins/nessus/132338

Comment 1 Marco Benatto 2019-12-30 21:07:11 UTC

Statement:

The trousers versions as shipped as Red Hat Enterprise Linux 5, 6, 7 and 8 are not affected by this issue. The flaw resides on the post transaction scriptlet from the RPM package. This scriptlet doesn't exists on Red Hat Enterprise Linux RPM spec file.

Comment 2 Marco Benatto 2019-12-30 21:08:36 UTC

Closing this flaw as NOTABUG as Red Hat's RPM packages for trousers doesn't execute the rpmsave data backup on post transaction scriptlet.