Bug 1904015 (CVE-2020-11867)

Summary:	CVE-2020-11867 audacity: insecure use of temporary directory leads to information disclosure
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dtimms, gemi, ian.s.mcinerney, manpaz, moez.roy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-12-03 17:33:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1904016, 1904017
Bug Blocks:

Description Marian Rehak 2020-12-03 11:38:05 UTC

Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there.

https://github.com/audacity/audacity/releases
https://salvatoresecurity.com/the-many-perils-of-tmp/

Comment 1 Marian Rehak 2020-12-03 11:38:35 UTC

Created audacity tracking bugs for this issue:

Affects: epel-all [bug 1904017]
Affects: fedora-all [bug 1904016]

Comment 2 Product Security DevOps Team 2020-12-03 17:33:54 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.