Bug 1182407 - (CVE-2021-31997) VUL-0: CVE-2021-31997: python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root
(CVE-2021-31997)
VUL-0: CVE-2021-31997: python-postorius: postorius-permissions.sh used during...
Status: RESOLVED WONTFIX
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Audits
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Andreas Schneider
Security Team bot
:
Depends on:
Blocks: 1180875
  Show dependency treegraph
 
Reported: 2021-02-18 09:29 UTC by Matthias Gerstner
Modified: 2022-01-03 10:57 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2021-02-18 09:29:08 UTC
+++ This bug was initially created as a clone of Bug #1182373

We are currently reviewing checked-in scripts and sources in OBS for security
issues.

In python-postorius the script postorius-permissions.sh is installed along
with the package and is also invoked in the %post section of the
postorius-web package.

In particular this script performs recursive ownership changes and ACL
settings as root on user controlled directories in /var/lib/postorius/data and
/var/log/postorius.

Since these directories are owned by the postorius and/or postorius-admin
users they can stage symlink attacks to pass ownership of arbitrary files in
the system to themselves. A compromised postorius or postorius-admin account
might therefore be able to perform a local root exploit.

Please perform safe operations here. For example:

- only perform the changes in ownership if the ownership does *not* match i.e.
  don't do it unconditionally.
- pass ownership of the root directory last.
- pass switches like -P to setfacl and -h to chown to make it not follow
  symbolic links.
- using `setpriv` or `su` to drop privileges to the owner of the root of the
  directory tree.

This script is very similar to the one in python-HyperKitty bsc#1182373. It
appears to be SUSE specific.
Comment 1 Matthias Gerstner 2021-04-01 11:23:09 UTC
Internal CRD: 2021-05-19 or earlier
Comment 2 Johannes Segitz 2021-05-04 08:17:23 UTC
Please have a look at this. You can reach out to us if you need additional help fixing this. Thank you
Comment 3 Andreas Schneider 2021-05-04 08:24:49 UTC
Please fix it if you have the time.
Comment 4 Matthias Gerstner 2021-05-17 09:48:53 UTC
(In reply to asn@cryptomilk.org from comment #3)
> Please fix it if you have the time.

The security team cannot maintain custom scripts for you. There are hundreds
of them in openSUSE:Factory alone and we have enough work on our hands just to
monitor them.

You can either fix it or remove the script. If there is no submission until
the CRD is over then we will need to file a delete request for this package
for openSUSE:Factory and openSUSE:Leap:*. The same goes for bug 1182373.
Comment 5 Matthias Gerstner 2021-05-20 08:15:13 UTC
CRD also crossed for this now. Publishing.
Comment 6 Johannes Segitz 2021-05-20 09:36:09 UTC
Please use CVE-2021-31997 for this
Comment 7 Andreas Schneider 2021-05-25 19:31:55 UTC
https://build.opensuse.org/request/show/895423
Comment 8 Matthias Gerstner 2021-06-22 11:59:16 UTC
OBS sr#896998 for Factory is still in staging. This sr# removes the
permissions script completely. Leap:15.2 does not contain the script. Keeping
this bug open until the fix made its way to Factory.
Comment 9 Matthias Gerstner 2021-10-08 13:30:05 UTC
(In reply to matthias.gerstner@suse.com from comment #8)
> OBS sr#896998 for Factory is still in staging. This sr# removes the
> permissions script completely. Leap:15.2 does not contain the script. Keeping
> this bug open until the fix made its way to Factory.

So the sr# got declined in Factory. I cannot make out the reason. The
problematic script is still in Factory. Could you please reiterate?
Comment 10 Matthias Gerstner 2022-01-03 10:57:58 UTC
The package has been removed from Factory due to the unfixed issues. In Leap
15.2 an older version without the script in question still exists. Therefore
closing this bug as WONTFIX until further notice.