CVE-2021-32553

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-59 CWE-61

Affected software

Vendor	Product	Versions
Canonical	apport	>= 2.20.1, < 2.20.1-0ubuntu2.30+esm1; >= 2.20.9, < 2.20.9-0ubuntu7.24; >= 2.20.11-0ubuntu27, < 2.20.11-0ubuntu27.18; >= 2.20.11-0ubuntu50, < 2.20.11-0ubuntu50.7; >= 2.20.11-0ubuntu65, < 2.20.11-0ubuntu65.1; >= 2.14.1-0ubuntu3, < 2.14.1-0ubuntu3.29+esm7

References

https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904Issue Tracking, Vendor Advisory
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904Issue Tracking, Vendor Advisory

Timeline

Published: Jun 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-325545.5It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg CVE-2021-325555.5It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-CVE-2021-325563.3It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a CVE-2021-325577.1It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.CVE-2021-325587.5An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certif CVE-2021-325596.5An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that w CVE-2021-32566.5KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the chakanhtml.module.php file.CVE-2021-325606.5The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.CVE-2021-325616.1OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.CVE-2021-325639.8An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it del CVE-2021-325657.5Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache CVE-2021-325667.5Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache T