CVE-2020-27348 json
snapcraft may build snaps with incorrect LD_LIBRARY_PATH
published 2020-12-04 5 y ago modified 2026-06-17 4 mo ago also GHSA-qxm5-vx5j-pp6w , PYSEC-2020-109 , EUVD-2020-0181
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
Patch / fix
- pypi snapcraft 2.43.1, 4.4.4
- Canonical snapcraft 2.43.1+16.04.1, 2.43.1+18.04.1, 4.4.4
- snapcraft Ubuntu 16.04 LTS 2.43.1+16.04.1
- snapcraft Ubuntu 18.04 LTS 2.43.1+18.04.1
ubuntu advisories UBUNTU-CVE-2020-27348
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/snapcore/snapcraft@a0ceca9 commit
- github.com/snapcore/snapcraft#3345 pull request
- usn.ubuntu.com/usn/usn-4661-1 advisory
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- bugs.launchpad.net https://bugs.launchpad.net/bugs/1901572 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L |
| NVD | 3.1 | 6.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | snapcraft | <4.4.4 <2.43.1 |
4.4.4 2.43.1 |
Affected products
- Canonical snapcraft
Classification
- Weakness
-
- CWE-427 Uncontrolled Search Path Element
References
-
github.com
/snapcore/snapcraft/pull/3345
web, third-party-advisory
-
usn.ubuntu.com
/usn/usn-4661-1
web, patch, third-party-advisory, advisory
-
github.com
/snapcore/snapcraft/commit/a0ceca9d531a34c979251030ed67b5fa2abfdd9a
web
-
bugs.launchpad.net
/bugs/1901572
web, exploit, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-27348
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/snapcraft/PYSEC-2020-109.yaml
web
-
github.com
/snapcore/snapcraft
package
-
github.com
/advisories/GHSA-qxm5-vx5j-pp6w
advisory
Sources
- CVE List CVE-2020-27348
- GitHub Advisory GHSA-qxm5-vx5j-pp6w
- NVD CVE-2020-27348
- OSV PYSEC-2020-109
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.