Bug 1155478 (CVE-2019-11481) - VUL-1: CVE-2019-11481: apport: local denial of service via arbitrary user-controlled settings
Summary: VUL-1: CVE-2019-11481: apport: local denial of service via arbitrary user-con...
Status: RESOLVED FIXED
Alias: CVE-2019-11481
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/246066/
Whiteboard: CVSSv3:SUSE:CVE-2019-11481:4.4:(AV:L/...
Keywords:
Depends on:
Blocks:
 
Reported: 2019-10-30 16:22 UTC by Alexander Bergmann
Modified: 2024-05-06 12:05 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2019-10-30 16:22:20 UTC 
CVE-2019-11481

Apport reads the potentially arbitrary user-controlled settings file as the
root user.

References:
https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1830862
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-11481
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-11481.html
Comment 1 Matej Cepl 2020-06-09 15:59:30 UTC 
I am not sure we can do anything about this issue in the given time and effort spent on it. We have in SLE-11 (the only distro where we have apport) apport-0.114-rev1189, whereas upstream (https://launchpad.net/apport) is on 2.20.4 (rev3266).

There is no proper analysis of the issue at https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1830862, nor there is anywhere clear indication of the patch which fixes it.

My suggestion is WONTFIX, because fixing this would probably require much more work than we are willing to spent on it.
Comment 2 Thomas Leroy 2024-05-06 12:05:55 UTC 
apport and apport-crashdb-sle are unsupported now. Closing