Description
The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openSUSE | Leap 15.1 | apt-cacher-ng – < 3.1-lp151.3.3.1 | 3.1-lp151.3.3.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | apt-cacher-ng | 3.1-bp151.4.3.1 | openSUSE-SU-2020:0146-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | apt-cacher-ng | 3.1-lp151.3.3.1 | openSUSE-SU-2020:0124-1 |
Advisories 2
- openSUSE-SU-2020:0146-1 Security update for apt-cacher-ng SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0124-1 Security update for apt-cacher-ng SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openSUSE-SU-2020:0124 vendor-advisory
- openSUSE-SU-2020:0146 vendor-advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1157703