AZL-9845
Dashboard / Vulnerabilities / AZL-9845
Summary: CVE-2022-1348 affecting package logrotate for versions less than 3.20.1-1
Details: A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
References: https://nvd.nist.gov/vuln/detail/CVE-2022-1348
Affected packages
Package
Name: logrotate
Purl: pkg:rpm/azure-linux/logrotate
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -3.20.1-1
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
