CVE-2021-32550: apport read_file() function could follow maliciously constructed symbolic links

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-12 · updated 2026-06-17
Weakness: CWE-59

Description

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.

Affected products

Canonical Ubuntu Linux: 18.04, 20.04, 20.10, 21.04, 21.10

References

https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904

Get alerted when CVE-2021-32550 or the next vulnerability affects your stack