CVE-2011-1155 — Logrotate vulnerability

CWE-3998 documents7 sources
Severity
1.9LOWNVD
EPSS
0.1%
top 73.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Logrotate Project LogrotateDebian LogrotateGentoo Logrotate
Timeline
PublishedMar 30
Latest updateMay 17

Description

The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

CVSS vector

AV:L/AC:M/C:N/I:N/A:PExploitability: 3.4 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/logrotate< logrotate 3.8.0-1 (bookworm)
▶Debianlogrotate_project/logrotate< 3.8.0-1+3
▶NVDgentoo/logrotate3.7.9+9

Patches

Patch: lists.fedoraproject.org ↗Patch: openwall.com ↗Patch: openwall.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fcm8-m55c-7v4r: The writeState function in logrotate↗2022-05-17
▶
OSV
CVE-2011-1155: The writeState function in logrotate↗2011-03-30
▶

📋Vendor Advisories

3
Ubuntu
logrotate vulnerabilities↗2011-07-21
▶
Red Hat
logrotate: DoS due improper escaping of file names within 'write state' action↗2011-02-13
▶
Debian
CVE-2011-1155: logrotate - The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allo...↗2011
▶

💬Community

2
Bugzilla
CVE-2011-1098 CVE-2011-1154 CVE-2011-1155 logrotate various flaws [fedora-all]↗2011-03-17
▶
Bugzilla
CVE-2011-1155 logrotate: DoS due improper escaping of file names within 'write state' action↗2011-02-27
▶