CVE-2017-20148 In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because of insecure recursive chown calls.
CriticalCVSS 9.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because of insecure recursive chown calls.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/logcheck | <= 1.3.23 | No fix listed |
| ubuntu/logcheck(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/logcheck(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/logcheck(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/logcheck(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- bugs.gentoo.org exploit issue-tracking patch third-party-advisory
- GLSA-202209-10 third-party-advisory vendor-advisory