USN-4707-1: TCMU vulnerability

Releases

• Ubuntu 20.10
• Ubuntu 20.04 LTS

Packages

• tcmu - TCM-Userspace backend

Details

It was discovered that TCMU lacked a check for transport-layer restrictions,
allowing remote attackers to read or write files via directory traversal in
an XCOPY request.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.10

• libtcmu2 - 1.5.2-5ubuntu0.20.10.1
• tcmu-runner - 1.5.2-5ubuntu0.20.10.1

Ubuntu 20.04

• libtcmu2 - 1.5.2-5ubuntu0.20.04.1
• tcmu-runner - 1.5.2-5ubuntu0.20.04.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-3139