CVE-2020-35766

HIGH

OpenDKIM < 2.10.3 - Privilege Escalation via Symlink Attack on /tmp/testkeys

Title source: llm
STIX 2.1

Description

The test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges via a symlink attack against the /tmp/testkeys file (related to t-testdata.h, t-setup.c, and t-cleanup.c). NOTE: this is applicable to persons who choose to engage in the "A number of self-test programs are included here for unit-testing the library" situation.

References (1)

Core 1
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://github.com/trusteddomainproject/OpenDKIM/issues/113

Scores

CVSS v3 7.8
EPSS 0.0052
EPSS Percentile 39.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-59
Status published
Products (1)
opendkim/opendkim < 2.10.3
Published Dec 28, 2020
Tracked Since Feb 18, 2026