CVE-2020-14004 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-14004 Interim 1 25 2025-02-17T01:27:00Z current 2021-05-30T14:40:52Z 2025-02-17T01:27:00Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-14004 An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2022-October/012665.html E-Mail link for SUSE-SU-2022:3725-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZD7VWVAWJW6BVEJDA2VL4JOZDY6R2CYT/ E-Mail link for openSUSE-SU-2020:1820-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Module for HPC 12 SP2 SUSE Package Hub 15 SP1 SUSE Package Hub 15 SP2 openSUSE Leap 15.1 openSUSE Leap 15.2 openSUSE Tumbleweed icinga2 icinga2-2.12.1-bp151.3.3.4 icinga2-2.12.1-bp152.4.3.1 icinga2-2.12.1-lp151.2.3.4 icinga2-2.12.1-lp152.3.3.3 icinga2-2.13.1-1.3 icinga2-2.8.2-3.6.1 icinga2-bin-2.12.1-bp151.3.3.4 icinga2-bin-2.12.1-bp152.4.3.1 icinga2-bin-2.12.1-lp151.2.3.4 icinga2-bin-2.12.1-lp152.3.3.3 icinga2-bin-2.13.1-1.3 icinga2-bin-2.8.2-3.6.1 icinga2-common-2.12.1-bp151.3.3.4 icinga2-common-2.12.1-bp152.4.3.1 icinga2-common-2.12.1-lp151.2.3.4 icinga2-common-2.12.1-lp152.3.3.3 icinga2-common-2.13.1-1.3 icinga2-common-2.8.2-3.6.1 icinga2-doc-2.12.1-bp151.3.3.4 icinga2-doc-2.12.1-bp152.4.3.1 icinga2-doc-2.12.1-lp151.2.3.4 icinga2-doc-2.12.1-lp152.3.3.3 icinga2-doc-2.13.1-1.3 icinga2-doc-2.8.2-3.6.1 icinga2-ido-mysql-2.12.1-bp151.3.3.4 icinga2-ido-mysql-2.12.1-bp152.4.3.1 icinga2-ido-mysql-2.12.1-lp151.2.3.4 icinga2-ido-mysql-2.12.1-lp152.3.3.3 icinga2-ido-mysql-2.13.1-1.3 icinga2-ido-mysql-2.8.2-3.6.1 icinga2-ido-pgsql-2.12.1-bp151.3.3.4 icinga2-ido-pgsql-2.12.1-bp152.4.3.1 icinga2-ido-pgsql-2.12.1-lp151.2.3.4 icinga2-ido-pgsql-2.12.1-lp152.3.3.3 icinga2-ido-pgsql-2.13.1-1.3 icinga2-ido-pgsql-2.8.2-3.6.1 icinga2-libs-2.8.2-3.6.1 nano-icinga2-2.12.1-bp151.3.3.4 nano-icinga2-2.12.1-bp152.4.3.1 nano-icinga2-2.12.1-lp151.2.3.4 nano-icinga2-2.12.1-lp152.3.3.3 nano-icinga2-2.13.1-1.3 vim-icinga2-2.12.1-bp151.3.3.4 vim-icinga2-2.12.1-bp152.4.3.1 vim-icinga2-2.12.1-lp151.2.3.4 vim-icinga2-2.12.1-lp152.3.3.3 vim-icinga2-2.13.1-1.3 vim-icinga2-2.8.2-3.6.1 icinga2-2.8.2-3.6.1 as a component of SUSE Linux Enterprise Module for HPC 12 icinga2-bin-2.8.2-3.6.1 as a component of SUSE Linux Enterprise Module for HPC 12 icinga2-common-2.8.2-3.6.1 as a component of SUSE Linux Enterprise Module for HPC 12 icinga2-doc-2.8.2-3.6.1 as a component of SUSE Linux Enterprise Module for HPC 12 icinga2-ido-mysql-2.8.2-3.6.1 as a component of SUSE Linux Enterprise Module for HPC 12 icinga2-ido-pgsql-2.8.2-3.6.1 as a component of SUSE Linux Enterprise Module for HPC 12 icinga2-libs-2.8.2-3.6.1 as a component of SUSE Linux Enterprise Module for HPC 12 vim-icinga2-2.8.2-3.6.1 as a component of SUSE Linux Enterprise Module for HPC 12 icinga2-2.12.1-bp151.3.3.4 as a component of SUSE Package Hub 15 SP1 icinga2-bin-2.12.1-bp151.3.3.4 as a component of SUSE Package Hub 15 SP1 icinga2-common-2.12.1-bp151.3.3.4 as a component of SUSE Package Hub 15 SP1 icinga2-doc-2.12.1-bp151.3.3.4 as a component of SUSE Package Hub 15 SP1 icinga2-ido-mysql-2.12.1-bp151.3.3.4 as a component of SUSE Package Hub 15 SP1 icinga2-ido-pgsql-2.12.1-bp151.3.3.4 as a component of SUSE Package Hub 15 SP1 nano-icinga2-2.12.1-bp151.3.3.4 as a component of SUSE Package Hub 15 SP1 vim-icinga2-2.12.1-bp151.3.3.4 as a component of SUSE Package Hub 15 SP1 icinga2-2.12.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 icinga2-bin-2.12.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 icinga2-common-2.12.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 icinga2-doc-2.12.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 icinga2-ido-mysql-2.12.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 icinga2-ido-pgsql-2.12.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 nano-icinga2-2.12.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 vim-icinga2-2.12.1-bp152.4.3.1 as a component of SUSE Package Hub 15 SP2 icinga2-2.12.1-lp151.2.3.4 as a component of openSUSE Leap 15.1 icinga2-bin-2.12.1-lp151.2.3.4 as a component of openSUSE Leap 15.1 icinga2-common-2.12.1-lp151.2.3.4 as a component of openSUSE Leap 15.1 icinga2-doc-2.12.1-lp151.2.3.4 as a component of openSUSE Leap 15.1 icinga2-ido-mysql-2.12.1-lp151.2.3.4 as a component of openSUSE Leap 15.1 icinga2-ido-pgsql-2.12.1-lp151.2.3.4 as a component of openSUSE Leap 15.1 nano-icinga2-2.12.1-lp151.2.3.4 as a component of openSUSE Leap 15.1 vim-icinga2-2.12.1-lp151.2.3.4 as a component of openSUSE Leap 15.1 icinga2-2.12.1-lp152.3.3.3 as a component of openSUSE Leap 15.2 icinga2-bin-2.12.1-lp152.3.3.3 as a component of openSUSE Leap 15.2 icinga2-common-2.12.1-lp152.3.3.3 as a component of openSUSE Leap 15.2 icinga2-doc-2.12.1-lp152.3.3.3 as a component of openSUSE Leap 15.2 icinga2-ido-mysql-2.12.1-lp152.3.3.3 as a component of openSUSE Leap 15.2 icinga2-ido-pgsql-2.12.1-lp152.3.3.3 as a component of openSUSE Leap 15.2 nano-icinga2-2.12.1-lp152.3.3.3 as a component of openSUSE Leap 15.2 vim-icinga2-2.12.1-lp152.3.3.3 as a component of openSUSE Leap 15.2 icinga2-2.13.1-1.3 as a component of openSUSE Tumbleweed icinga2-bin-2.13.1-1.3 as a component of openSUSE Tumbleweed icinga2-common-2.13.1-1.3 as a component of openSUSE Tumbleweed icinga2-doc-2.13.1-1.3 as a component of openSUSE Tumbleweed icinga2-ido-mysql-2.13.1-1.3 as a component of openSUSE Tumbleweed icinga2-ido-pgsql-2.13.1-1.3 as a component of openSUSE Tumbleweed nano-icinga2-2.13.1-1.3 as a component of openSUSE Tumbleweed vim-icinga2-2.13.1-1.3 as a component of openSUSE Tumbleweed icinga2 as a component of SUSE Linux Enterprise Module for HPC 12 SP2 An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user. CVE-2020-14004 SUSE Linux Enterprise Module for HPC 12:icinga2-2.8.2-3.6.1 SUSE Linux Enterprise Module for HPC 12:icinga2-bin-2.8.2-3.6.1 SUSE Linux Enterprise Module for HPC 12:icinga2-common-2.8.2-3.6.1 SUSE Linux Enterprise Module for HPC 12:icinga2-doc-2.8.2-3.6.1 SUSE Linux Enterprise Module for HPC 12:icinga2-ido-mysql-2.8.2-3.6.1 SUSE Linux Enterprise Module for HPC 12:icinga2-ido-pgsql-2.8.2-3.6.1 SUSE Linux Enterprise Module for HPC 12:icinga2-libs-2.8.2-3.6.1 SUSE Linux Enterprise Module for HPC 12:vim-icinga2-2.8.2-3.6.1 SUSE Package Hub 15 SP1:icinga2-2.12.1-bp151.3.3.4 SUSE Package Hub 15 SP1:icinga2-bin-2.12.1-bp151.3.3.4 SUSE Package Hub 15 SP1:icinga2-common-2.12.1-bp151.3.3.4 SUSE Package Hub 15 SP1:icinga2-doc-2.12.1-bp151.3.3.4 SUSE Package Hub 15 SP1:icinga2-ido-mysql-2.12.1-bp151.3.3.4 SUSE Package Hub 15 SP1:icinga2-ido-pgsql-2.12.1-bp151.3.3.4 SUSE Package Hub 15 SP1:nano-icinga2-2.12.1-bp151.3.3.4 SUSE Package Hub 15 SP1:vim-icinga2-2.12.1-bp151.3.3.4 SUSE Package Hub 15 SP2:icinga2-2.12.1-bp152.4.3.1 SUSE Package Hub 15 SP2:icinga2-bin-2.12.1-bp152.4.3.1 SUSE Package Hub 15 SP2:icinga2-common-2.12.1-bp152.4.3.1 SUSE Package Hub 15 SP2:icinga2-doc-2.12.1-bp152.4.3.1 SUSE Package Hub 15 SP2:icinga2-ido-mysql-2.12.1-bp152.4.3.1 SUSE Package Hub 15 SP2:icinga2-ido-pgsql-2.12.1-bp152.4.3.1 SUSE Package Hub 15 SP2:nano-icinga2-2.12.1-bp152.4.3.1 SUSE Package Hub 15 SP2:vim-icinga2-2.12.1-bp152.4.3.1 openSUSE Leap 15.1:icinga2-2.12.1-lp151.2.3.4 openSUSE Leap 15.1:icinga2-bin-2.12.1-lp151.2.3.4 openSUSE Leap 15.1:icinga2-common-2.12.1-lp151.2.3.4 openSUSE Leap 15.1:icinga2-doc-2.12.1-lp151.2.3.4 openSUSE Leap 15.1:icinga2-ido-mysql-2.12.1-lp151.2.3.4 openSUSE Leap 15.1:icinga2-ido-pgsql-2.12.1-lp151.2.3.4 openSUSE Leap 15.1:nano-icinga2-2.12.1-lp151.2.3.4 openSUSE Leap 15.1:vim-icinga2-2.12.1-lp151.2.3.4 openSUSE Leap 15.2:icinga2-2.12.1-lp152.3.3.3 openSUSE Leap 15.2:icinga2-bin-2.12.1-lp152.3.3.3 openSUSE Leap 15.2:icinga2-common-2.12.1-lp152.3.3.3 openSUSE Leap 15.2:icinga2-doc-2.12.1-lp152.3.3.3 openSUSE Leap 15.2:icinga2-ido-mysql-2.12.1-lp152.3.3.3 openSUSE Leap 15.2:icinga2-ido-pgsql-2.12.1-lp152.3.3.3 openSUSE Leap 15.2:nano-icinga2-2.12.1-lp152.3.3.3 openSUSE Leap 15.2:vim-icinga2-2.12.1-lp152.3.3.3 openSUSE Tumbleweed:icinga2-2.13.1-1.3 openSUSE Tumbleweed:icinga2-bin-2.13.1-1.3 openSUSE Tumbleweed:icinga2-common-2.13.1-1.3 openSUSE Tumbleweed:icinga2-doc-2.13.1-1.3 openSUSE Tumbleweed:icinga2-ido-mysql-2.13.1-1.3 openSUSE Tumbleweed:icinga2-ido-pgsql-2.13.1-1.3 openSUSE Tumbleweed:nano-icinga2-2.13.1-1.3 openSUSE Tumbleweed:vim-icinga2-2.13.1-1.3 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H