PT-2018-2299 · Linux+5 · Libcgroup+5

Matthias Gerstner · Published 2018-07-18 · Updated 2021-03-15 · CVE-2018-14348

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions libcgroup up to and including 0.41

Description The issue is related to the creation of the /var/log/cgred file with mode 0666, regardless of the configured umask, leading to potential disclosure of information. This could allow a remote attacker to gain unauthorized access to information.

Recommendations For libcgroup up to and including 0.41, consider changing the permissions of the /var/log/cgred file to a more restrictive mode to minimize the risk of information disclosure. As a temporary workaround, restrict access to the /var/log/cgred file until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2019-2557

ALT-PU-2020-1303

ALT-PU-2020-1408

AZL-6615

BDU:2019-00427

CESA-2019_2047

CVE-2018-14348

DLA-1472-1

MGASA-2018-0380

OPENSUSE-SU-2018_2241-1

RHSA-2019:2047

RHSA-2019_2047

SUSE-SU-2018:2142-1

SUSE-SU-2018:2143-1

SUSE-SU-2018:2468-1

SUSE-SU-2018_2142-1

SUSE-SU-2018_2143-1

SUSE-SU-2018_2468-1

USN-4845-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Libcgroup

References · 31

• https://sourceforge.net/p/libcg/libcg/ci/0d88b73d189ea3440ccaab00418d6469f76fa590 · Patch
• https://advisories.mageia.org/MGASA-2018-0380.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:2142-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-14348 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6615 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3VH333EONOEEGKOLHHFXCJYHCYMHJ4KK · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14348 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4845-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14348 · Security Note
• https://bdu.fstec.ru/vul/2019-00427 · Security Note
• https://ubuntu.com/security/notices/USN-4845-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2468-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14348 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2143-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00023.html · Vendor Advisory