This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-44512 →

DEBIAN-CVE-2021-44512

World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of sessio...

Original description

The description as published by the source.

World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 tmate-ssh-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-68-gd7334ee4-1"}]}]

Debian:14 tmate-ssh-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-68-gd7334ee4-1"}]}]

References

advisory security-tracker.debian.org