FreedomBox symlink flaw allows access to files without permission
Ordinary FreedomBox users can read and change other people's files.
Summary
Unprivileged user accounts on FreedomBox can read and write files they lack permission for by making authorized_keys a symlink. FreedomBox is a Debian Pure Blend, so it is distributed through Debian repositories.
Affected when
- An unprivileged user account exists
What to do
Check that you run a version newer than 26.15, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen