CVE-2021-23239

Published: Jan 12, 2021Modified: Jun 17, 2026

2.5

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.0 / Impact: 1.4

Source: NVD

Description

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

Affected (8)

Products: Sudo Project: Sudo · Netapp: Cloud Backup, Hci Management Node, Solidfire · Fedoraproject: Fedora · +1 more

Show all products

Sudo Project: Sudo · Netapp: Cloud Backup, Hci Management Node, Solidfire · Fedoraproject: Fedora · Debian: Debian Linux

1 product

3 products

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Sudo Project Sudo	Before 1.8.32
Sudo Project Sudo	From 1.9.0 to 1.9.5

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Hci Management Node	All versions
Netapp Solidfire	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (14)

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-23239

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/11/msg00007.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE42Y35SMJOLONAIBNYNFC7J44UUZ2Y6/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMY4VSSBIND7VAYSN6T7XIWJRWG4GBB3/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202101-33

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210129-0010/

Source: cve@mitre.org

Third Party Advisory

https://www.sudo.ws/stable.html#1.9.5

Source: cve@mitre.org

Release NotesVendor Advisory

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-23239