Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.

This update for shibboleth-sp fixes the following issues :

Security issue fixed :

CVE-2019-19191: Fixed escalation to root by fixing ownership of log files (bsc#1157471).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for shibboleth-sp fixes the following issues :

Security issue fixed :

  - CVE-2019-19191: Fixed escalation to root by fixing     ownership of log files (bsc#1157471).

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Type	Severity
133037	SUSE SLES12 Security Update : shibboleth-sp (SUSE-SU-2020:0115-1)	Nessus	SuSE Local Security Checks	Local	high
132907	openSUSE Security Update : shibboleth-sp (openSUSE-2020-20)	Nessus	SuSE Local Security Checks	Local	high
132396	SUSE SLES15 Security Update : shibboleth-sp (SUSE-SU-2019:3386-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2019-19191

high

Tenable Plugins

high

high

high