Skip to content
Fencer Intel
medium 6.2

CVE-2020-8017 json

race condition on texlive-filesystem cron job allows for the deletion of unintended files

published 6y ago modified 4mo ago also EUVD-2020-28930

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.

Patch / fix

  • SUSE SUSE Linux Enterprise Module for Desktop Applications 15-SP1 2017.135-9.5.1
  • SUSE SUSE Linux Enterprise Software Development Kit 12-SP4 2013.74-16.5.1
  • SUSE SUSE Linux Enterprise Software Development Kit 12-SP5 2013.74-16.5.1
  • openSUSE openSUSE Leap 15.1 2017.135-lp151.8.3.1
  • texlive-filesystem SLE Module for Desktop Applications 15 SP2, SLE Module for Desktop Applications 15 SP1 2017.135-9.12.1
  • texlive SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 2013.20130620-22.8.2
  • texlive-filesystem SLE Software Development Kit 12 SP5, SLE Software Development Kit 12 SP4 2013.74-16.12.1
  • texlive SLE Module for Desktop Applications 15 SP1 2017.20170520-11.13.2

suse advisories SUSE-SU-2020:1580-2SUSE-SU-2020:1581-1SUSE-SU-2020:1580-1

  • texlive-filesystem openSUSE Tumbleweed 2021.185.svn54495-52.2
  • texlive-filesystem openSUSE Leap 15.1 2017.135-lp151.8.6.1
  • texlive openSUSE Leap 15.1 2017.20170520-lp151.12.3.1

opensuse advisories openSUSE-SU-2024:11432-1openSUSE-SU-2020:0804-1

Is CVE-2020-8017 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD 2.0 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P

Affected products

  • SUSE SUSE Linux Enterprise Module for Desktop Applications 15-SP1
  • SUSE SUSE Linux Enterprise Software Development Kit 12-SP4
  • SUSE SUSE Linux Enterprise Software Development Kit 12-SP5
  • openSUSE openSUSE Leap 15.1

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.