CVE-2020-8025
outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
- Record
CVE-2020-8025- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-279
- Updated
- 2026-11-02
EUVDEUVD-2020-28937
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
- Record
EUVD-2020-28937- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g55h-q572-52j6 No score
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux...
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
- Record
GHSA-g55h-q572-52j6- Updated
- 2026-11-02
NVD
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
- Record
CVE-2020-8025- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-279
- Updated
- 2026-11-02
OSVSUSE-SU-2021:0197-1 No score
Security update for permissions
This update for permissions fixes the following issues:
- Update to version 20181224:
- pcp: remove no longer needed / conflicting entries (bsc#1171883, CVE-2020-8025)
- Record
SUSE-SU-2021:0197-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1292-1 No score
Security update for pcp
This update for pcp fixes the following issues:
- Fixed completely CVE-2020-8025 (bsc#1171883)
- Record
SUSE-SU-2021:1292-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1509-1 No score
Security update for pcp
This update for pcp fixes the following issues:
- CVE-2020-8025: Fixed outdated entries in permissions profiles for /var/lib/pcp/tmp/* (bsc#1171883).
- Record
SUSE-SU-2022:1509-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1873-1 No score
Security update for pcp
This update for pcp fixes the following issues:
- CVE-2020-8025: Fixed outdated entries in permissions profiles for /var/lib/pcp/tmp/* (bsc#1171883).
- Record
SUSE-SU-2022:1873-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
permissionsSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 20181224-23.3.1 | 20181224-23.3.1 |
pcpSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 3.11.9-5.11.5 | 3.11.9-5.11.5 |
pcpSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 3.11.9-5.11.5 | 3.11.9-5.11.5 |
pcpSUSE:Linux Enterprise Server 15-LTSS |
before 3.11.9-5.11.5 | 3.11.9-5.11.5 |
pcpSUSE:Linux Enterprise Server for SAP Applications 15 |
before 3.11.9-5.11.5 | 3.11.9-5.11.5 |
pcpopenSUSE:Leap 15.3 |
before 3.11.9-150000.5.14.1 | 3.11.9-150000.5.14.1 |
pcpopenSUSE:Leap 15.4 |
before 3.11.9-150000.5.14.1 | 3.11.9-150000.5.14.1 |
pcpSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 3.11.9-6.17.1 | 3.11.9-6.17.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8025 is a medium vulnerability (CVSS 6.1) in Opensuse Leap 15.1, published August 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in permissions 20181224-23.3.1.