What’s Vulnerable › Vulnerabilities

CVE-2022-21950: canna: unsafe handling of /tmp/.iroha_unix directory

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-07 · updated 2026-06-17
• Weakness: CWE-284

Description

A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior to canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 canna versions prior to 3.7p3-bp154.3.3.1. openSUSE Factory was also affected. Instead of fixing the package it was deleted there.

Affected products

• openSUSE Canna: before 3.7p3-bp153.2.3.1; before 3.7p3-bp154.3.3.1; 3.7p3 — fixed in 3.7p3-bp153.2.3.1, 3.7p3-bp154.3.3.1

How to fix

Upgrade to a fixed version: openSUSE Canna 3.7p3-bp153.2.3.1, 3.7p3-bp154.3.3.1. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=1199280
• https://bugzilla.suse.com/show_bug.cgi?id=1199280

Get alerted when CVE-2022-21950 or the next vulnerability affects your stack