Lack of data validation - Path Traversal In policycoreutils
Description
Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 2.7-1 | ||
debian 14 | 2.7-1 | ||
debian 12 | 2.7-1 | ||
debian 13 | 2.7-1 | ||
 rpm rhel6 | - | - | |
rpm rhel7 | 0:2.5-22.el7 |
Aliases
1. 2. 3. 4. 5.