CVE-2021-26720

Katalog CVE

CVSS 7.8 · High EPSS 0,40%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada avahi, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.

Rincian

Terbit di NVD

17 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982796 mailing list · advisory pihak ketiga
• https://bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824 issue tracking · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=1180827 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html mailing list · advisory pihak ketiga
• https://metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog broken link · advisory pihak ketiga
• https://packages.debian.org/bullseye/avahi-daemon product · advisory pihak ketiga
• https://packages.debian.org/buster/avahi-daemon product · advisory pihak ketiga
• https://packages.debian.org/sid/avahi-daemon product · advisory pihak ketiga
• https://security-tracker.debian.org/tracker/CVE-2021-26720 advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2021/02/15/2 mailing list · advisory pihak ketiga