Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

SUSE: 2022:4150-1 Important: CNI Arbitrary Path Injection

suse
Calendar Grey November 21, 2022
Scroller Suse
SUSE Security Advisory on cnf addresses CVE-2021-20207 with critical assessment and setup guidelines. Maintain safety!
An update that fixes one vulnerability is now available

Summary

This update for cni fixes the following issues: - CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration (bsc#1181961). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Public Cloud 15: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-2022-4150=1 Package List: - SUSE Linux Enterprise Module for Public Cloud 15 (x86_64): cni-0.7.1-150000.1.7.1

Topics%20covered

Topics Covered

security advisory software patch important SUSE CNI arbitrary path injection

References

#1181961

Cross- CVE-2021-20206

CVSS scores:

CVE-2021-20206 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE-2021-20206 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise High Performance Computing 15

SUSE Linux Enterprise Module for Public Cloud 15

SUSE Linux Enterprise Server 15

SUSE Linux Enterprise Server for SAP Applications 15

https://www.suse.com/security/cve/CVE-2021-20206.html

https://bugzilla.suse.com/1181961

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:4150-1
Rating: important

Topics%20covered

Topics Covered

security advisory software patch important SUSE CNI arbitrary path injection

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.