CVE catalog

CVE-2022-3560

pesign: CVE-2022-3560

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Jan 1, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 27, 2026

A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pesign	sid	`117-2`	fixed
Debian	pesign	forky	`116-8.1`	fixed
Debian	pesign	trixie	`116-8.1`	fixed
Debian	pesign	bookworm	`0.112-6`	vulnerable
Suse	pesign	linux enterprise module for basesystem 15 sp4	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise high performance computing 15 sp1-ltss	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise high performance computing 15 sp2-ltss	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise high performance computing 15 sp3-espos	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise high performance computing 15 sp3-ltss	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise real time 15 sp3	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise server 15 sp1-ltss	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise server 15 sp2-ltss	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise server 15 sp3-ltss	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise server for sap applications 15 sp1	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise server for sap applications 15 sp2	`0.112-150000.4.15.1`	fixed
Suse	pesign	linux enterprise server for sap applications 15 sp3	`0.112-150000.4.15.1`	fixed
Suse	pesign	manager proxy 4.2	`0.112-150000.4.15.1`	fixed
Suse	pesign	manager server 4.2	`0.112-150000.4.15.1`	fixed
Suse	pesign	enterprise storage 7	`0.112-150000.4.15.1`	fixed
Suse	pesign	enterprise storage 7.1	`0.112-150000.4.15.1`	fixed
Opensuse	pesign	leap 15.4	`0.112-150000.4.15.1`	fixed
Opensuse	pesign	tumbleweed	`113-11.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pesign	source	sid	`116-1`	not yet assigned	Not reported	[1030168]
Debian	pesign	source	forky	`116-1`	not yet assigned	Not reported	[1030168]
Debian	pesign	source	trixie	`116-1`	not yet assigned	Not reported	[1030168]
Debian	pesign	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1030168]
Suse	pesign	rpm	linux enterprise module for basesystem 15 sp4	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise high performance computing 15 sp1-ltss	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise high performance computing 15 sp2-ltss	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise high performance computing 15 sp3-espos	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise high performance computing 15 sp3-ltss	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise real time 15 sp3	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise server 15 sp1-ltss	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise server 15 sp2-ltss	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise server 15 sp3-ltss	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise server for sap applications 15 sp1	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise server for sap applications 15 sp2	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	linux enterprise server for sap applications 15 sp3	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	manager proxy 4.2	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	manager server 4.2	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	enterprise storage 7	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Suse	pesign	rpm	enterprise storage 7.1	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Opensuse	pesign	rpm	leap 15.4	`0.112-150000.4.15.1`	Not reported	SUSE-SU-2023:0484-1	Not reported
Opensuse	pesign	rpm	tumbleweed	`113-11.1`	Not reported	OPENSUSE-SU-2024:12672-1	Not reported

[Debian bug #1030168]

Notes

[bookworm] pesign: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[pesign]Affected
Details (2)
- 0.112-6 · amd64 · bookworm
  Affected
  dsa · pesign · debian · bookworm
- 0.112-6 · arm64 · bookworm
  Affected
  dsa · pesign · debian · bookworm

[openSUSE Tumbleweed]

[pesign-systemd]Unknown
Source package: [pesign]
Details (1)
- 116-11.2 · noarch · tumbleweed
  Unknown · Fixed: 113-11.1
  Version impact unknown
  dsa · pesign · opensuse · tumbleweed
[pesign]Fixed
Source package: [pesign]
Details (1)
- 116-11.2 · x86_64 · tumbleweed
  Fixed · Fixed: 113-11.1
  dsa · pesign · opensuse · tumbleweed

Observed: Oct 23, 2026, 6:28:16 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]