new snapcraft issue

2020/27xxx/CVE-2020-27348.json

@@ -1,18 +1,115 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
+        "ASSIGNER": "security@ubuntu.com",
+        "DATE_PUBLIC": "2020-12-03T18:16:00.000Z",
         "ID": "CVE-2020-27348",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "STATE": "PUBLIC",
+        "TITLE": "snapcraft may build snaps with incorrect LD_LIBRARY_PATH"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "snapcraft",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "4.4",
+                                            "version_value": "4.4.4"
+                                        },
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "2.43.1",
+                                            "version_value": "2.43.1+16.04.1"
+                                        },
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "2.43.1",
+                                            "version_value": "2.43.1+18.04.1"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "Canonical"
+                }
+            ]
+        }
+    },
+    "credit": [
+        {
+            "lang": "eng",
+            "value": "itszn"
+        }
+    ],
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1."
             }
         ]
+    },
+    "generator": {
+        "engine": "Vulnogram 0.0.9"
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "LOW",
+            "attackVector": "LOCAL",
+            "availabilityImpact": "LOW",
+            "baseScore": 6.8,
+            "baseSeverity": "MEDIUM",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "LOW",
+            "scope": "UNCHANGED",
+            "userInteraction": "REQUIRED",
+            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-427 Uncontrolled Search Path Element"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "refsource": "CONFIRM",
+                "url": "https://github.com/snapcore/snapcraft/pull/3345"
+            },
+            {
+                "refsource": "CONFIRM",
+                "url": "https://usn.ubuntu.com/usn/usn-4661-1"
+            },
+            {
+                "refsource": "CONFIRM",
+                "url": "https://bugs.launchpad.net/bugs/1901572"
+            }
+        ]
+    },
+    "source": {
+        "advisory": "https://usn.ubuntu.com/usn/usn-4661-1",
+        "defect": [
+            "https://bugs.launchpad.net/bugs/1901572"
+        ],
+        "discovery": "EXTERNAL"
     }
-}
+}