Skip to content
Fencer Intel
low 3.3

CVE-2021-25317 json

cups: ownership of /var/log/cups allows the lp user to create files as root

published 5y ago modified last mo. also EUVD-2021-12215

cvss
3.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.

Patch / fix

  • SUSE SUSE Linux Enterprise Server 11-SP4-LTSS 1.3.9
  • SUSE SUSE Manager Server 4.0 2.2.7
  • SUSE SUSE OpenStack Cloud Crowbar 9 1.7.5
  • openSUSE openSUSE Leap 15.2 2.2.7
  • cups SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 2.2.7-3.26.1
  • cups SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 1.7.5-20.36.1
  • cups SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 1.3.9-8.46.56.18.1

suse advisories SUSE-SU-2021:1454-1SUSE-SU-2021:1453-1SUSE-SU-2021:14712-1

  • cups openSUSE Tumbleweed 2.3.3op2-4.2
  • cups openSUSE Leap 15.2 2.2.7-lp152.9.9.1

opensuse advisories openSUSE-SU-2024:10707-1openSUSE-SU-2021:0638-1

Is CVE-2021-25317 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-25317 updated cvss 2.0

cups: insecure permissions of /var/log/cups allows for symlink attacks

  • Red Hat Enterprise Linux 6 cups, cups-lpd, cups-php, cups-libs
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 cups, cups-lpd, cups-libs, cups-client, cups-ipptool, cups-filesystem Red Hat Enterprise Linux 8 cups, cups-lpd, cups-libs, cups-client, cups-ipptool, cups-filesystem Red Hat Enterprise Linux 9 cups, cups-lpd, cups-libs, cups-client, cups-ipptool, cups-filesystem, +1 more
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last mo.

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • SUSE SUSE Linux Enterprise Server 11-SP4-LTSS
  • SUSE SUSE Manager Server 4.0
  • SUSE SUSE OpenStack Cloud Crowbar 9
  • openSUSE openSUSE Leap 15.2
  • openSUSE Factory

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.