CVEvulnerability
CVE-2020-24330
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-08-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-269
Description
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.
Affected configurations
• trousers project trousers (<= 0.3.14)
• fedoraproject fedora 33
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- http://www.openwall.com/lists/oss-security/2020/08/14/1 Exploit, Mailing List, Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1164472 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/ lists.fedoraproject.org
- https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch Mailing List, Patch, Third Party Advisory
- https://sourceforge.net/p/trousers/mailman/message/37015817/ Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/08/14/1 Exploit, Mailing List, Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1164472 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/ lists.fedoraproject.org
- https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch Mailing List, Patch, Third Party Advisory
- https://sourceforge.net/p/trousers/mailman/message/37015817/ Exploit, Mailing List, Third Party Advisory