Description
A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | SUSE Linux Enterprise High Performance Computing 15-ESPOS | pcp – < 3.11.9-5.8.1 | 3.11.9-5.8.1 |
| SUSE | SUSE Linux Enterprise High Performance Computing 15-LTSS | pcp – < 3.11.9-5.8.1 | 3.11.9-5.8.1 |
| SUSE | SUSE Linux Enterprise Module for Development Tools 15 | pcp – < 3.11.9-5.8.1 | 3.11.9-5.8.1 |
| SUSE | SUSE Linux Enterprise Module for Development Tools 15-SP1 | pcp – < 4.3.1-3.5.3 | 4.3.1-3.5.3 |
| SUSE | SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 | pcp – < 3.11.9-5.8.1 | 3.11.9-5.8.1 |
| SUSE | SUSE Linux Enterprise Server 15-LTSS | pcp – < 3.11.9-5.8.1 | 3.11.9-5.8.1 |
| SUSE | SUSE Linux Enterprise Server for SAP 15 | pcp – < 3.11.9-5.8.1 | 3.11.9-5.8.1 |
| SUSE | SUSE Linux Enterprise Software Development Kit 12-SP4 | pcp – < 3.11.9-6.14.1 | 3.11.9-6.14.1 |
| SUSE | SUSE Linux Enterprise Software Development Kit 12-SP5 | pcp – < 3.11.9-6.14.1 | 3.11.9-6.14.1 |
| openSUSE | openSUSE Leap 15.1 | pcp – < 4.3.1-lp151.2.3.1 | 4.3.1-lp151.2.3.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | pcp +95 | 5.0.2-5.el8 | RHBA-2020:1628 |
| RHEL 7 | pcp +97 | 4.3.2-12.el7 | RHSA-2020:3869 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | pcp | 4.3.1-3.5.3 | SUSE-SU-2020:0355-1 |
| SLES 15 | pcp | 3.11.9-5.8.1 | SUSE-SU-2020:0357-1 |
| SLES 12 SP5 | pcp | 3.11.9-6.14.1 | SUSE-SU-2020:0356-1 |
| SLES 12 SP4 | pcp | 3.11.9-6.14.1 | SUSE-SU-2020:0356-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | pcp | 3.11.9-5.8.1 | SUSE-SU-2020:0357-1 |
| SLE HPC 15 | pcp | 3.11.9-5.8.1 | SUSE-SU-2020:0357-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pcp | 5.2.2-3.4 | openSUSE-SU-2024:11152-1 |
| openSUSE Leap 15.1 | pcp | 4.3.1-lp151.2.3.1 | openSUSE-SU-2020:0213-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pcp +96 | 4.3.2-12.amzn2.0.1 | ALAS2-2020-1561 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | pcp +97 | 4.3.2-12.el7 | ELSA-2020-3869 |
Advisories 10
- RHSA-2020:3869 Red Hat Security Advisory: pcp security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-2020:0356-1 Security update for pcp SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0355-1 Security update for pcp SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11152-1 libpcp-devel-5.2.2-3.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0213-1 Security update for pcp SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0357-1 Security update for pcp SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0012 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 5, 2026
- RHBA-2020:1628 Red Hat Bug Fix Advisory: pcp bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ALAS2-2020-1561 Low: pcp security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 11, 2020
- ELSA-2020-3869 Low: pcp security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 6, 2020