The cgrulesengd daemon (cgred) in libcgroup through version 0.41 creates log files (/var/log/cgred) with world readable and writable permissions (0o666) due to a reset of the file mode creation mask (umask(0)) in the daemon/cgrulesengd.c:cgre_start_daemon() function (CVE-2018-14348). . MGASA-2018-0380 - Updated libcgroup packages fix security vulnerability Publication date: 21 Sep 2018 URL: https://advisories.mageia.org/MGASA-2018-0380.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-14348 The cgrulesengd daemon (cgred) in libcgroup through version 0.41 creates log files (/var/log/cgred) with world readable and writable permissions (0o666) due to a reset of the file mode creation mask (umask(0)) in the daemon/cgrulesengd.c:cgre_start_daemon() function (CVE-2018-14348). References: - https://bugs.mageia.org/show_bug.cgi?id=23380 - https://lists.fedoraproject.org/archives/list/
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for rsyslog ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:2453-1 Rating: moderate References: #935393 Cross-References: CVE-2015-3243 Affected Products: SUSE CaaS Platform 3.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rsyslog fixes the following issues: The following security vulnerability was addressed: CVE-2015-3243: Make sure that log files are not created world-readable (bsc#935393) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE CaaS Platform 3.0: To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - SUSE CaaS Platform 3.0 (x86_64): rsyslog-8.24.0-3.11.1 rsyslog-debuginfo-8.24.0-3.11.1 rsyslog-debugsource-8.24.0-3.11.1 References: https://www.suse.com/security/cve/CVE-2015-3243.html https://bugzilla.suse.com/935393 . The recent patch from SUSE for rsyslog resolves a significant concern regarding log file access rights, bolstering overall system protection.. SUSE CaaS, rsyslog update, security patch. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.