A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.

An update of the logrotate package has been released.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8393 advisory.

  - A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent     parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the     state file does not exist, it is created with world-readable permission, allowing an unprivileged user to     lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
    (CVE-2022-1348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-8393 advisory.

    - fix potential DoS from unprivileged users via the state file (CVE-2022-1348)

    * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com>

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:8393 advisory.

  - A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent     parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the     state file does not exist, it is created with world-readable permission, allowing an unprivileged user to     lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
    (CVE-2022-1348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8393 advisory.

    The logrotate utility simplifies the administration of multiple log files by allowing their automatic     rotation, compression, removal, and mailing.

    Security Fix(es):

    * logrotate: potential DoS from unprivileged users via the state file (CVE-2022-1348)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-189 advisory.

    A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent     parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the     state file does not exist, it is created with world-readable permission, allowing an unprivileged user to     lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
    (CVE-2022-1348)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-095 advisory.

    A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent     parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the     state file does not exist, it is created with world-readable permission, allowing an unprivileged user to     lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
    (CVE-2022-1348)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-084 advisory.

    A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent     parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the     state file does not exist, it is created with world-readable permission, allowing an unprivileged user to     lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
    (CVE-2022-1348)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2396-1 advisory.

  - A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent     parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the     state file does not exist, it is created with world-readable permission, allowing an unprivileged user to     lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
    (CVE-2022-1348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5447-1 advisory.

    It was discovered that logrotate incorrectly handled the state file. A local attacker could possibly use     this issue to keep a lock on the state file and cause logrotate to stop working, leading to a denial of     service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203256	Photon OS 4.0: Logrotate PHSA-2023-4.0-0349	Nessus	PhotonOS Local Security Checks	medium
184837	Rocky Linux 9 : logrotate (RLSA-2022:8393)	Nessus	Rocky Linux Local Security Checks	medium
168098	Oracle Linux 9 : logrotate (ELSA-2022-8393)	Nessus	Oracle Linux Local Security Checks	medium
167837	AlmaLinux 9 : logrotate (ALSA-2022:8393)	Nessus	Alma Linux Local Security Checks	medium
167602	RHEL 9 : logrotate (RHSA-2022:8393)	Nessus	Red Hat Local Security Checks	medium
167003	Amazon Linux 2022 : logrotate (ALAS2022-2022-189)	Nessus	Amazon Linux Local Security Checks	medium
164753	Amazon Linux 2022 : logrotate (ALAS2022-2022-095)	Nessus	Amazon Linux Local Security Checks	medium
164719	Amazon Linux 2022 : logrotate (ALAS2022-2022-084)	Nessus	Amazon Linux Local Security Checks	medium
163240	SUSE SLED15 / SLES15 Security Update : logrotate (SUSE-SU-2022:2396-1)	Nessus	SuSE Local Security Checks	medium
161615	Ubuntu 22.04 LTS : logrotate vulnerability (USN-5447-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2022-1348

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium