CVE-2022-1348
Medium
Description
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Logrotate
PublishedMay 25, 2022
First seenMay 25, 2022
Weakness typeCWE-732CWE-732
How to fix
Update
- logrotate_project logrotate3.20.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| logrotate_project logrotate | 3.17.0 ≤ v < 3.20.0 | 3.20.0 |
| fedoraproject fedora | 35, 36 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.