CVE-2020-24331

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
VendorProductVersion
trousers_projecttrousers
𝑥
≤ 0.3.14
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
trousers
bullseye
unimportant
bookworm
0.3.15-0.3
fixed
sid
0.3.15-0.4
fixed
trixie
0.3.15-0.4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
trousers
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
ignored
jammy
not-affected
impish
ignored
hirsute
ignored
groovy
ignored
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
dne
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2020/08/14/1
https://bugzilla.suse.com/show_bug.cgi?id=1164472
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/
https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch
https://sourceforge.net/p/trousers/mailman/message/37015817/
http://www.openwall.com/lists/oss-security/2020/08/14/1
https://bugzilla.suse.com/show_bug.cgi?id=1164472
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/
https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch
https://sourceforge.net/p/trousers/mailman/message/37015817/