Summary
This update for permissions fixes the following issues:
- CVE-2020-8013: Fixed an improper check which could have allowed the
setting of unintented setuid bits (bsc#1163922).
- Fixed handling of relative directory symlinks in chkstat.
- Whitelisted postgres sticky directories (bsc#1123886).
- Fixed regression where chkstat broke when /proc was not available
(bsc#1160764, bsc#1160594)
- Fixed capability handling when doing multiple permission changes
at once (bsc#1161779)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| SUSE · SLES 12 SP4 Linux Enterprise Desktop 12 SP4 | permissions | 20170707-3.21.1 |
| SUSE · SLES 12 SP4 Linux Enterprise Server 12 SP4 | permissions | 20170707-3.21.1 |
| SUSE · SLES 12 SP5 Linux Enterprise Server 12 SP5 | permissions | 20170707-3.21.1 |
| SUSE · SLES for SAP 12 SP4 Linux Enterprise Server for SAP Applications 12 SP4 | permissions | 20170707-3.21.1 |
| SUSE · SLES for SAP 12 SP5 Linux Enterprise Server for SAP Applications 12 SP5 | permissions | 20170707-3.21.1 |
Vulnerabilities 1
-
Low 2.2
permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim
A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously foll…