VYPR
← All advisories
Medium severity6.8NVD Advisory· Published Dec 4, 2020· Updated Jun 17, 2026

CVE-2020-27348

CVE-2020-27348

Description

In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
snapcraftPyPI
< 4.4.44.4.4

Affected products

5
  • Canonical/Snapcraft
    cpe:2.3:a:canonical:snapcraft:*:*:*:*:*:*:*:*
    Range: <4.4.4
  • Canonical/Ubuntu Linux2 versions
    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:pypi/snapcraft
    Range: < 4.4.4
  • Canonical/snapcraftv5
    Range: 4.4

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.