← Back

CVE-2021-32556

nvd nist
Published: Jun 12, 2021Modified: Jun 17, 2026

JSON object

Loading...
3.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 1.8 / Impact: 1.4
Source: NVD

Description

It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.

Affected (6)

Products: Canonical: Apport
Canonical
1 product
Apport
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Apport
From 2.14.1-0ubuntu3 to 2.14.1-0ubuntu3.29\+esm7
Apport
From 2.20.1 to 2.20.1-0ubuntu2.30\+esm1
Apport
From 2.20.11-0ubuntu27 to 2.20.11-0ubuntu27.18
Apport
From 2.20.11-0ubuntu50 to 2.20.11-0ubuntu50.7
Apport
From 2.20.11-0ubuntu65 to 2.20.11-0ubuntu65.1
Apport
From 2.20.9 to 2.20.9-0ubuntu7.24

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

Source: security@ubuntu.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.