CVE-2018-14348
Published: 14 August 2018
libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information.
From the Ubuntu Security Team
It was discovered that libcgroup incorrectly handled log file permissions. An attacker could possibly use thise issue to obtain sensitive information.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libcgroup Launchpad, Ubuntu, Debian |
bionic |
Released
(0.41-8ubuntu2+esm1)
Available with Ubuntu Pro |
| cosmic |
Ignored
(end of life)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Not vulnerable
(0.41-10)
|
|
| focal |
Not vulnerable
(0.41-10)
|
|
| groovy |
Not vulnerable
(0.41-10)
|
|
| hirsute |
Not vulnerable
(0.41-10)
|
|
| impish |
Not vulnerable
(0.41-10)
|
|
| jammy |
Not vulnerable
(0.41-10)
|
|
| kinetic |
Not vulnerable
(0.41-10)
|
|
| lunar |
Not vulnerable
(0.41-10)
|
|
| trusty |
Released
(0.38-1ubuntu2+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Needs triage
|
|
| xenial |
Released
(0.41-7ubuntu1+esm1)
Available with Ubuntu Pro |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.1 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |