PatchTheCVECVE-2021-31998: A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3;
CVE-2021-31998 is a medium-severity flaw (CVSS 6.8) affecting inn. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2
Why this priority
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 75%) |
| CISA exploited list | No |
| Weakness | CWE-276 |
| Published | 2021-06-10 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-31998?
inn: upgrade to 2.6.2. Exact commands for each OS are on this page.
Is CVE-2021-31998 being exploited?
CVE-2021-31998 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-31998 affect?
CVE-2021-31998 affects inn. Severity is medium (CVSS 6.8). A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root.
How urgent is CVE-2021-31998?
Priority 40/100. Public exploit reference; On your watchlist
Related CVEs
- CVE-2019-3692 HIGH 7.7 UPGRADE DOWNGRADE The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to
- CVE-2012-3523 MEDIUM 6.8 UPGRADE The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allow
- CVE-2004-0045 HIGH 7.5 DOWNGRADE Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow
- CVE-2002-0526 HIGH 7.2 UPGRADE Vulnerability in (1) inews or (2) rnews for INN 2.2.3 and earlier, related to insecure open() calls.
- CVE-2002-0525 HIGH 10.0 DOWNGRADE Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote