CVE-2019-18901
Summary
| CVE | CVE-2019-18901 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-03-02 16:15:00 UTC |
| Updated | 2022-11-16 03:34:00 UTC |
| Description | A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1. |
Risk And Classification
Problem Types: CWE-59
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Operating System | Suse | Linux Enterprise Server | 12 | All | All | All |
| Operating System | Suse | Linux Enterprise Server | 15 | All | All | All |
| Operating System | Suse | Linux Enterprise Server | 12 | All | All | All |
| Operating System | Suse | Linux Enterprise Server | 15 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug 1160895 – VUL-0: CVE-2019-18901: mariadb: mysql-systemd-helper: race condition with mysql_upgrade_info | CONFIRM | bugzilla.suse.com | Issue Tracking, Vendor Advisory |
| [security-announce] openSUSE-SU-2020:0289-1: moderate: Security update f | SUSE | lists.opensuse.org | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Matthias Gerstner
There are currently no legacy QID mappings associated with this CVE.