CVE-2021-32557: Canonical Apport

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.

Affected products

• Canonical Apport: from 2.14.1-0ubuntu3, before 2.14.1-0ubuntu3.29\+esm7 (fixed in 2.14.1-0ubuntu3.29\+esm7); from 2.20.1, before 2.20.1-0ubuntu2.30\+esm1 (fixed in 2.20.1-0ubuntu2.30\+esm1); from 2.20.9, before 2.20.9-0ubuntu7.24 (fixed in 2.20.9-0ubuntu7.24); from 2.20.11-0ubuntu27, before 2.20.11-0ubuntu27.18 (fixed in 2.20.11-0ubuntu27.18); from 2.20.11-0ubuntu50, before 2.20.11-0ubuntu50.7 (fixed in 2.20.11-0ubuntu50.7); from 2.20.11-0ubuntu65, before 2.20.11-0ubuntu65.1 (fixed in 2.20.11-0ubuntu65.1)

Published 2021-06-12. Last modified 2026-06-17.