SB2020061831 - Information disclosure in Debian Linux
Published: June 18, 2020 Updated: August 8, 2020
Security Bulletin ID
SB2020061831
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2019-13033)
The vulnerability allows a local authenticated user to gain access to sensitive information.
In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans.
Remediation
Install update from vendor's website.
References
- https://cisofy.com/security/cve/cve-2019-13033/
- https://lists.debian.org/debian-lts-announce/2020/06/msg00024.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/