CVE-2021-27229 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 85%

Affected Products (NVD)

Vendor	Product	Version
mumble	mumble	𝑥 < 1.3.4
debian	debian_linux	9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

mumble

bookworm	1.3.4-4 fixed
bullseye	1.3.4-1 fixed
sid	1.5.517-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

mumble

bionic	Fixed 1.2.19-1ubuntu1.1 released
focal	Fixed 1.3.0+dfsg-1ubuntu0.1 released
groovy	ignored
hirsute	Fixed 1.3.4-1 released
impish	Fixed 1.3.4-1 released
jammy	Fixed 1.3.4-1 released
trusty	dne
xenial	Fixed 1.2.12-1ubuntu1+esm1 released

Common Weakness Enumeration

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References

https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f6879d16bfd648

https://github.com/mumble-voip/mumble/compare/1.3.3...1.3.4

https://github.com/mumble-voip/mumble/pull/4733

https://lists.debian.org/debian-lts-announce/2021/02/msg00022.html

https://security.gentoo.org/glsa/202105-13

https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f6879d16bfd648

https://github.com/mumble-voip/mumble/compare/1.3.3...1.3.4

https://github.com/mumble-voip/mumble/pull/4733

https://lists.debian.org/debian-lts-announce/2021/02/msg00022.html

https://security.gentoo.org/glsa/202105-13