CVE-2023-1326

High

Description

A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.

SeverityHigh

CVSS7.7

Exploit probability—

ProductCanonical Apport

PublishedApr 13, 2023

First seenApr 13, 2023

Weakness typeCWE-269Improper privilege management

How to fix

Patches

github.com/canonical/apport/commit/e5f78cc89f1f5888b6a56b785dddcb0364c48ecb

Vendor advisories

ubuntu.com/security/notices/USN-6018-1

Affected products

Product	Affected versions	Fixed in
canonical apport	v ≤ 2.26.0	—
canonical ubuntu_linux	18.04, 20.04, 22.04, 22.10	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.