AZL-34786
Dashboard / Vulnerabilities / AZL-34786
Summary: CVE-2021-3981 affecting package grub2 for versions less than 2.06-14
Details: A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released.
References: https://nvd.nist.gov/vuln/detail/CVE-2021-3981
Affected packages
Package
Name: grub2
Purl: pkg:rpm/azure-linux/grub2
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -2.06-14
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
