ByteOS Network

NVD Vulnerability Details :

CVE-2021-3155

Analyzed

Source-security@ubuntu.com

Published At-17 Feb, 2022 | 23:15

Updated At-25 Feb, 2022 | 21:32

snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	3.8	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

Canonical Ltd.

>>snapd>>Versions before 2.54.3(exclusive)

cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>18.04

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Canonical Ltd.

>>ubuntu_linux>>20.04

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Canonical Ltd.

>>ubuntu_linux>>21.10

cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-276	Primary	nvd@nist.gov
CWE-276	Secondary	security@ubuntu.com

References

Hyperlink	Source	Resource
https://github.com/snapcore/snapd/commit/6bcaeeccd16ed8298a301dd92f6907f88c24cc85	security@ubuntu.com	Patch Third Party Advisory
https://github.com/snapcore/snapd/commit/7d2a966620002149891446a53cf114804808dcca	security@ubuntu.com	Patch Third Party Advisory
https://ubuntu.com/security/notices/USN-5292-1	security@ubuntu.com	Patch Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History