CVE-2021-32547: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2021-32547 is a security vulnerability discovered in the read_file() function within apport/hookutils.py. The vulnerability was disclosed on May 25, 2021, affecting the Apport crash reporting system in Ubuntu Linux distributions. The issue specifically impacts the openjdk-lts package apport hooks, where the read_file() function would follow symbolic links or open FIFOs, potentially exposing private data to other local users (Ubuntu Security, NVD).

The vulnerability exists in the read_file() function implementation within apport/hookutils.py. When this function is used by the openjdk-lts package apport hooks, it fails to properly validate file paths, allowing it to follow symbolic links and open FIFO files without appropriate security checks. The vulnerability has been assigned a CVSS 3.1 base score of 5.5 (Medium), with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates local access is required, low attack complexity, low privileges required, no user interaction needed, unchanged scope, high confidentiality impact, and no impact on integrity or availability (Ubuntu Security).

The vulnerability could allow local attackers to expose private data to other local users through symbolic link manipulation. The impact is primarily focused on confidentiality, with a high confidentiality impact rating but no impact on system integrity or availability (Ubuntu Security).

The vulnerability requires local access to the system and low privileges to exploit. The attack complexity is rated as low, requiring no user interaction to execute. The vulnerability was discovered by Maik Münch and has been confirmed to be exploitable on default Ubuntu installations (Launchpad Bug).

The vulnerability has been fixed in multiple Ubuntu versions through security updates. Fixed versions include: Ubuntu 22.04 LTS (2.20.11-0ubuntu67), 21.10 (2.20.11-0ubuntu67), 21.04 (2.20.11-0ubuntu65.1), 20.04 LTS (2.20.11-0ubuntu27.18), 18.04 LTS (2.20.9-0ubuntu7.24), 16.04 LTS (2.20.1-0ubuntu2.30+esm1), and 14.04 LTS (2.14.1-0ubuntu3.29+esm7). Users are advised to update their systems to the patched versions (Ubuntu Security).