title: Apport info disclosure via path traversal bug in read_file
description: An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;
problem types: CWE-24 Path Traversal: '../filedir'
affected:
{
product: apport
vendor: Canonical
versions:
lessThan: 2.14.1-0ubuntu3.29+esm8, status: affected, version: 2.14.1, versionType: custom
lessThan: 2.20.1-0ubuntu2.30+esm2, status: affected, version: 2.20.1, versionType: custom
lessThan: 2.20.9-0ubuntu7.26, status: affected, version: 2.20.9, versionType: custom
changes: [at: 2.20.11-0ubuntu65.3, status: unaffected], lessThan: 2.20.11-0ubuntu27.20, status: affected, version: 2.20.11, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]