{"id":"CVE-2021-32000","aliases":["EUVD-2021-18870","GHSA-54r8-8cq2-5p82","SUSE-SU-2022:3667-1","SUSE-SU-2022:3674-1","openSUSE-SU-2024:12840-1"],"status":"published","title":"clone-master-clean-up: dangerous file system operations","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux Enterprise Server 12 SP3 clone-master-clean-up version 1.6-4.6.1 and prior versions. SUSE Linux Enterprise Server 15 SP1 clone-master-clean-up version 1.6-3.9.1 and prior versions. openSUSE Factory clone-master-clean-up version 1.6-1.4 and prior versions.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00296,"percentile":0.22479,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59","CWE-61"],"published":"2021-07-28T09:35:11Z","modified":"2026-06-17T03:52:39Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"clone-master-clean-up","fixed_in":["1.8-150100.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"clone-master-clean-up","fixed_in":["1.8-150100.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"clone-master-clean-up","fixed_in":["1.8-150100.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"clone-master-clean-up","fixed_in":["1.8-150100.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"clone-master-clean-up","fixed_in":["1.8-4.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"clone-master-clean-up","fixed_in":["1.8-4.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"clone-master-clean-up","fixed_in":["1.11-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"clone-master-clean-up","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-150100.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"clone-master-clean-up","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-150100.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"clone-master-clean-up","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-150100.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"clone-master-clean-up","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-150100.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"clone-master-clean-up","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"clone-master-clean-up","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-4.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"clone-master-clean-up","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11-1.1"}]}]}],"products":[{"vendor":"opensuse","product":"factory"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"opensuse_factory"},{"vendor":"suse","product":"suse linux enterprise server 12 sp3"},{"vendor":"suse","product":"suse linux enterprise server 15 sp1"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1181050","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32000"},{"url":"https://github.com/advisories/GHSA-54r8-8cq2-5p82"},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223667-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181050","tags":["report"]},{"url":"https://bugzilla.suse.com/1203651","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32000","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223674-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-32000","title":"clone-master-clean-up: dangerous file system operations","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux Enterprise Server 12 SP3 clone-master-clean-up version 1.6-4.6.1 and prior versions. SUSE Linux Enterprise Server 15 SP1 clone-master-clean-up version 1.6-3.9.1 and prior versions. openSUSE Factory clone-master-clean-up version 1.6-1.4 and prior versions.","status":"published","published":"2021-07-28T09:35:11.535Z","modified":"2024-09-16T17:48:09.451Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"cna"}],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-18870","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux Enterprise Server 12 SP3 clone-master-clean-up version 1.6-4.6.1 and prior versions. SUSE Linux Enterprise Server 15 SP1 clone-master-clean-up version 1.6-3.9.1 and prior versions. openSUSE Factory clone-master-clean-up version 1.6-1.4 and prior versions.","status":"published","published":"2021-07-28T09:35:11Z","modified":"2024-09-16T17:48:09Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T00:55:38.742114Z"}],"ghsa":[{"id":"GHSA-54r8-8cq2-5p82","title":"A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of...","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files.\nThis issue affects:\nSUSE Linux Enterprise Server 12 SP3\nclone-master-clean-up version 1.6-4.6.1 and prior versions.\nSUSE Linux Enterprise Server 15 SP1\nclone-master-clean-up version 1.6-3.9.1 and prior versions.\nopenSUSE Factory\nclone-master-clean-up version 1.6-1.4 and prior versions.","status":"published","published":"2022-05-24T19:09:17Z","modified":"2023-01-27T05:03:03Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-59","CWE-61"],"updated_at":"2026-11-02T14:42:09.625504Z"}],"nvd":[{"id":"CVE-2021-32000","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux Enterprise Server 12 SP3 clone-master-clean-up version 1.6-4.6.1 and prior versions. SUSE Linux Enterprise Server 15 SP1 clone-master-clean-up version 1.6-3.9.1 and prior versions. openSUSE Factory clone-master-clean-up version 1.6-1.4 and prior versions.","status":"published","published":"2021-07-28T10:15:07.943Z","modified":"2026-06-17T03:52:39.173Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.6,"vector":"AV:L/AC:L/Au:N/C:N/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"openSUSE-SU-2024:12840-1","title":"clone-master-clean-up-1.11-1.1 on GA media","description":"These are all security issues fixed in the clone-master-clean-up-1.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:35.461732Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2022:3667-1","title":"Security update for clone-master-clean-up","description":"This update for clone-master-clean-up fixes the following issues:\n\n- CVE-2021-32000: Fixed some potentially dangerous file system operations (bsc#1181050).\n\nBugfixes:\n- Fixed clone-master-clean-up failing to remove btrfs snapshots (bsc#1203651).\n","status":"published","published":"2022-10-19T19:34:45Z","modified":"2026-02-04T02:19:16.993861Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3674-1","title":"Security update for clone-master-clean-up","description":"This update for clone-master-clean-up fixes the following issues:\n\n  - CVE-2021-32000: Fixed some potentially dangerous file system operations (bsc#1181050).\n\n  Bugfixes:\n\n  - Fixed failures to remove btrfs snapshots (bsc#1203651).\n\n","status":"published","published":"2022-10-20T10:35:04Z","modified":"2026-02-04T03:27:41.302534Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}