Bug 2057700 (CVE-2022-25643)
Summary: | CVE-2022-25643 seatd-launch: allows file deletion with escalated privledges | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Anten Skrabec <askrabec> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED UPSTREAM | QA Contact: | |
Severity: | urgent | Docs Contact: | |
Priority: | urgent | ||
Version: | unspecified | CC: | alebastr89, sway-sig |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | seatd 0.6.4 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2022-03-02 23:50:52 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 2057701, 2057702 | ||
Bug Blocks: |
Description
Anten Skrabec
2022-02-23 21:13:50 UTC
Created seatd tracking bugs for this issue: Affects: fedora-34 [bug 2057701] Affects: fedora-35 [bug 2057702] Not affected: 1. seatd-launch is disabled in our build of seatd. We never shipped the vulnerable component to Fedora users. 2. Even if the user rebuilds the package with `--with server`, SUID bit required for exploiting the vulnerability is not set by default 3. 0.6.4 update is already published for all supported branches This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products. |