CVE-2022-2787 - Vulnerability Details - OpenCVE

Description

Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.

Published: 2022-08-27

Score: 4.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Debian

schroot

affected

Version	Status	Constraints
`unspecified`	affected	< 1.6.13

Configuration 1 [-]

OR	cpe:2.3:a:debian:schroot::::::::
	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-3075-1	schroot security update
Debian DSA	DSA-5213-1	schroot security update
EUVD	EUVD-2022-35028	Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.
Ubuntu USN	USN-5584-1	Schroot vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.004.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d
https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html
https://lists.debian.org/debian-security-announce/2022/msg00182.html
https://security.gentoo.org/glsa/202210-11

History

No history.

Subscriptions

Debian Debian Linux Schroot

MITRE

Status: PUBLISHED

Assigner: debian

Published: 2022-08-27T11:30:20.934Z

Updated: 2024-09-16T19:51:44.215Z

Reserved: 2022-08-11T00:00:00.000Z

Link: CVE-2022-2787

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-08-27T12:15:08.243

Modified: 2024-11-21T07:01:41.723

Link: CVE-2022-2787

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-281

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-2787", "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "datePublished": "2022-08-27T11:30:20.934Z", "dateUpdated": "2024-09-16T19:51:44.215Z", "dateReserved": "2022-08-11T00:00:00.000Z"}, "containers": {"cna": {"title": "stricter rules on chroot names", "datePublic": "2022-08-18T00:00:00.000Z", "providerMetadata": {"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian", "dateUpdated": "2022-10-31T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session."}], "affected": [{"vendor": "Debian", "product": "schroot", "versions": [{"version": "unspecified", "lessThan": "1.6.13", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d"}, {"url": "https://lists.debian.org/debian-security-announce/2022/msg00182.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html"}, {"name": "GLSA-202210-11", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202210-11"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "insufficient sanitiztion of chroot and session names"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "https://lists.debian.org/debian-security-announce/2022/msg00182.html", "defect": ["DSA-5213-1"], "discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:46:04.604Z"}, "title": "CVE Program Container", "references": [{"url": "https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-security-announce/2022/msg00182.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html", "tags": ["x_transferred"]}, {"name": "GLSA-202210-11", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202210-11"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:debian:schroot:*:*:*:*:*:*:*:*", "matchCriteriaId": "85DE1817-3E35-432D-8EBD-E2F14AB6E032", "versionEndExcluding": "1.6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session."}, {"lang": "es", "value": "Schroot versiones anteriores a 1.6.13, presenta reglas demasiado permisivas en los nombres de chroot o de sesi\u00f3n, lo que permit\u00eda una denegaci\u00f3n de servicio en el servicio schroot para todos los usuarios que pudieran iniciar una sesi\u00f3n schroot."}], "id": "CVE-2022-2787", "lastModified": "2024-11-21T07:01:41.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-27T12:15:08.243", "references": [{"source": "security@debian.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d"}, {"source": "security@debian.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html"}, {"source": "security@debian.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.debian.org/debian-security-announce/2022/msg00182.html"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202210-11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.debian.org/debian-security-announce/2022/msg00182.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202210-11"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-281"}], "source": "nvd@nist.gov", "type": "Primary"}]}