CVE-2021-32554: apport read_file() function could follow maliciously constructed symbolic links

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-12 · updated 2026-06-17
Weakness: CWE-59

Description

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Affected products

Canonical Ubuntu Linux: 18.04, 20.04, 20.10, 21.04, 21.10

References

https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904

Get alerted when CVE-2021-32554 or the next vulnerability affects your stack