CVE-2018-14348 libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information.
HighCVSS 8.1
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgroup(Debian:12) | < 0.41-8.1 | 0.41-8.1 |
| debian/libcgroup(Debian:13) | < 0.41-8.1 | 0.41-8.1 |
| debian/libcgroup(Debian:14) | < 0.41-8.1 | 0.41-8.1 |
| libcgroup project libcgroup | <= 0.41 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| fedoraproject fedora | = 28 | No fix listed |
References
- Debian Security Tracker CVE-2018-14348 vendor-advisory
- openSUSE-SU-2018:2241 broken-link vendor-advisory
- RHSA-2019:2047 vendor-advisory
- bugzilla.suse.com issue-tracking third-party-advisory
- [debian-lts-announce] 20180820 [SECURITY] [DLA 1472-1] libcgroup security update mailing-list third-party-advisory
- FEDORA-2018-f6adf1cb62 vendor-advisory
- sourceforge.net patch third-party-advisory
- bugs.debian.org issue-tracking