advisories/27166.adv

type: security
subject: Updated chrony package fixes security vulnerability
CVE:
 - CVE-2020-14367
src:
  7:
   core:
     - chrony-3.4-2.1.mga7
description: |
  Chrony's method of opening its PID file could allow a compromised chrony user
  account to overwrite files in certain parts of the filesystem with chrony's
  PID, using a symlink attack (CVE-2020-14367).
references:
 - https://bugs.mageia.org/show_bug.cgi?id=27166
 - https://www.openwall.com/lists/oss-security/2020/08/21/1
ID: MGASA-2020-0341
1	type: security
2	subject: Updated chrony package fixes security vulnerability
3	CVE:
4	- CVE-2020-14367
5	src:
6	7:
7	core:
8	- chrony-3.4-2.1.mga7
9	description: \|
10	Chrony's method of opening its PID file could allow a compromised chrony user
11	account to overwrite files in certain parts of the filesystem with chrony's
12	PID, using a symlink attack (CVE-2020-14367).
13	references:
14	- https://bugs.mageia.org/show_bug.cgi?id=27166
15	- https://www.openwall.com/lists/oss-security/2020/08/21/1
16	ID: MGASA-2020-0341