pesign: CVE-2022-3560: Local privilege escalation on pesign systemd service

Debian Bug report logs - #1030168
pesign: CVE-2022-3560: Local privilege escalation on pesign systemd service

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: pesign: CVE-2022-3560: Local privilege escalation on pesign systemd service

Date: Tue, 31 Jan 2023 21:00:58 +0100

Source: pesign
Version: 0.112-6
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for pesign.

I'm filling it for now still as severity grave, but feel free to
downgrade if you do not agree on RC level bug. That said, it needs an
unprivileged with access to the pesign user or group.

The code has been substantial refactored upstream, and I think the
issue i still present in the older versions, where the service is
using the pesign-authorize-groups and pesign-authorize-users scripts.

CVE-2022-3560[0]:
| Local privilege escalation on pesign systemd service

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-3560
    https://www.cve.org/CVERecord?id=CVE-2022-3560
[1] https://www.openwall.com/lists/oss-security/2023/01/31/6
[2] https://github.com/rhboot/pesign/commit/d8a8c259994d0278c59b30b41758a8dd0abff998 

Regards,
Salvatore

Send a report that this bug log contains spam.