A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereferen...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Ubuntu:18.04:LTScockpit |
All versions→ Not listed |
Not listed |
| Ubuntu:20.04:LTScockpit |
All versions→ Not listed |
Not listed |
| Ubuntu:22.04:LTScockpit |
All versions→ Not listed |
Not listed |
| Ubuntu:24.04:LTScockpit |
All versions→ Not listed |
Not listed |
| Ubuntu:26.10cockpit |
All versions→ Not listed |
Not listed |
| Ubuntu:26.04:LTScockpit |
All versions→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- report ubuntu.com
- report cve.org
- report access.redhat.com
- report bugzilla.redhat.com
- report github.com
- report github.com