A flaw was found in systemd, where it mishandles numerical usernames beginning with decimal digits, or "0x" followed by hexadecimal digits.(CVE-2020-13776)
22703
07 November 2023
07 November 2023
CLOSED
MEDIUM
6.7 MEDIUM - Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVE-2020-13776
|
Brocade Security Advisory ID |
BSA-2023-1015 |
|
Component |
systemd |
|
|
|
Summary
Systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
Products Affected
- The underlying OS used by Brocade ASCG OVA versions prior to v3.0 - Fixed in Brocade ASCG v3.0
Products Confirmed Not Affected
- Brocade Fabric OS is Not Affected
- Brocade SANnav is Not Affected
Solution
Brocade has released security updates that address the vulnerabilities described in this advisory. Brocade Customers should obtain the security updates through their usual update channels.
Revision History
|
Version |
Change |
Date |
|
1.0 |
Initial Publication |
November 7, 2023 |
Disclaimer
THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.