A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:1509-1 advisory.

  - A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux     Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15;
    openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp     package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions     versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to     20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1.
    openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions     versions prior to 20200624. (CVE-2020-8025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1873-1 advisory.

  - A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux     Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15;
    openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp     package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions     versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to     20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1.
    openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions     versions prior to 20200624. (CVE-2020-8025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for pcp fixes the following issues :

Fixed completely CVE-2020-8025 (bsc#1171883)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for permissions fixes the following issues :

Update to version 20181224 :

  - pcp: remove no longer needed / conflicting entries     (bsc#1171883, CVE-2020-8025)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
170215	openSUSE 15 Security Update : pcp (SUSE-SU-2022:1509-1)	Nessus	SuSE Local Security Checks	critical
161653	SUSE SLES12 Security Update : pcp (SUSE-SU-2022:1873-1)	Nessus	SuSE Local Security Checks	critical
148929	SUSE SLES15 Security Update : pcp (SUSE-SU-2021:1292-1)	Nessus	SuSE Local Security Checks	critical
145300	SUSE SLED15 / SLES15 Security Update : permissions (SUSE-SU-2021:0197-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-8025

critical

Tenable Plugins

critical

critical

critical

critical