SecuritySpace - CVE-2022-3560

Vulnerability Search		Search 324607 CVE descriptions and 145615 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2022-3560

Description: A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.

Test IDs: 1.3.6.1.4.1.25623.1.0.827086 1.3.6.1.4.1.25623.1.1.4.2023.0484.1 1.3.6.1.4.1.25623.1.0.827090 1.3.6.1.4.1.25623.1.0.884278

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2022-3560
https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0
https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0

CVE ID:	CVE-2022-3560
Description:	A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.
Test IDs:	1.3.6.1.4.1.25623.1.0.827086 1.3.6.1.4.1.25623.1.1.4.2023.0484.1 1.3.6.1.4.1.25623.1.0.827090 1.3.6.1.4.1.25623.1.0.884278
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2022-3560 https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0 https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0