{"id":"CVE-2021-31998","aliases":["EUVD-2021-18869","GHSA-rqpg-j7j6-g58g","SUSE-SU-2021:14750-1","UBUNTU-CVE-2021-31998","openSUSE-SU-2021:0830-1","openSUSE-SU-2021:0845-1"],"status":"published","title":"inn: %post calls user owned file allowing local privilege escalation to root","description":"A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00318,"percentile":0.2496,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2021-06-03T16:05:19Z","modified":"2026-10-17T12:56:15Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"inn","fixed_in":["2.4.2-170.21.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"inn","fixed_in":["2.4.2-170.21.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"inn","fixed_in":["2.6.2-lp152.2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"inn","fixed_in":["2.6.2-bp152.2.8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"inn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-170.21.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"inn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-170.21.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"inn2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.4-3","2.6.0-1","2.6.0-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"inn2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1-2build1","2.6.1-3","2.6.1-4","2.6.1-4build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"inn2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3-2build1","2.6.3-2build2","2.6.3-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"inn2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4-2build1","2.6.4-2build2","2.6.4-2build3","2.6.4-2build4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"inn2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.2~20230806-1","2.7.2~20230917-1","2.7.2~20231223-1","2.7.2~20240120-1ubuntu1","2.7.2~20240212-1","2.7.2~20240212-1build2","2.7.2~20240212-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"inn2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3~20250201-1","2.7.3~rc1-1","2.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"inn2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.4~20250809-1build1","2.7.4~20260419-1","2.7.4-1","2.7.4-1build1","2.7.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"inn2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-1","2.7.4~20250809-1","2.7.4~20250809-1build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"inn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-lp152.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"inn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-bp152.2.8.1"}]}]}],"products":[{"vendor":"opensuse","product":"inn"},{"vendor":"opensuse","product":"opensuse backports sle-15-sp2"},{"vendor":"opensuse","product":"opensuse leap 15.2"},{"vendor":"suse","product":"suse linux enterprise server 11-sp3"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1182321","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31998"},{"url":"https://github.com/advisories/GHSA-rqpg-j7j6-g58g"},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114750-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182321","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31998","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-31998","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31998","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7WPHWRLIUN6FJFWJTZWJNHGURPDXI3KU/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L66SY5KJMRBUJVLIGSLIQAWIALH62ZA2/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-31998","title":"inn: %post calls user owned file allowing local privilege escalation to root","description":"A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.","status":"published","published":"2021-06-10T11:25:11.178Z","modified":"2024-09-16T22:40:51.163Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:33:05.331617Z"}],"euvd":[{"id":"EUVD-2021-18869","description":"A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.","status":"published","published":"2021-06-10T11:25:11Z","modified":"2024-09-16T22:40:51Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:00.660655Z"}],"ghsa":[{"id":"GHSA-rqpg-j7j6-g58g","title":"A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise...","description":"A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.","status":"published","published":"2022-05-24T19:04:54Z","modified":"2023-01-29T05:06:58Z","cwes":["CWE-276"],"updated_at":"2026-11-02T14:46:07.768849Z"}],"nvd":[{"id":"CVE-2021-31998","description":"A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.","status":"published","published":"2021-06-10T12:15:08.92Z","modified":"2026-06-17T03:52:38.94Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"UBUNTU-CVE-2021-31998","description":"A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.","status":"published","published":"2021-06-10T12:15:00Z","modified":"2026-10-17T12:56:15.055510534Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"openSUSE-SU-2021:0830-1","title":"Security update for inn","description":"This update for inn fixes the following issues:\n\n- CVE-2021-31998: change user to news before calling innupgrade, which could have \n  allow local privilege escalation.\n  [boo#1182321]\n","status":"published","published":"2021-06-03T16:05:19Z","modified":"2025-05-07T18:12:50.169994Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0845-1","title":"Security update for inn","description":"This update for inn fixes the following issues:\n\n- CVE-2021-31998: change user to news before calling innupgrade, which could have \n  allow local privilege escalation.\n  [boo#1182321]\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-06-06T22:06:06Z","modified":"2026-02-04T02:40:14.645597Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"SUSE-SU-2021:14750-1","title":"Security update for inn","description":"This update for inn fixes the following issues:\n\n- CVE-2021-31998: Fixed locale privialge escalation during the update of inn (bsc#1182321).\n","status":"published","published":"2021-06-17T08:52:13Z","modified":"2026-02-04T04:22:20.126032Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}