Description
A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior to canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 canna versions prior to 3.7p3-bp154.3.3.1. openSUSE Factory was also affected. Instead of fixing the package it was deleted there.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openSUSE | openSUSE Backports SLE-15-SP3 | canna – < canna-3.7p3-bp153.2.3.1 | canna-3.7p3-bp153.2.3.1 |
| openSUSE | openSUSE Backports SLE-15-SP4 | canna – < 3.7p3-bp154.3.3.1 | 3.7p3-bp154.3.3.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | canna | 3.7p3-bp154.3.3.1 | openSUSE-SU-2022:10091-1 |
| SUSE Package Hub 15 SP3 | canna | 3.7p3-bp153.2.3.1 | openSUSE-SU-2022:10090-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | canna | 3.7p3-bp154.3.3.1 | openSUSE-SU-2022:10091-1 |
| openSUSE Leap 15.3 | canna | 3.7p3-bp153.2.3.1 | openSUSE-SU-2022:10090-1 |
Advisories 2
- openSUSE-SU-2022:10090-1 Security update for canna SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:10091-1 Security update for canna SUSE / openSUSE Security Updates · Feb 4, 2026