LAYER: meta
PACKAGE NAME: logrotate
PACKAGE VERSION: 3.21.0
CVE: CVE-2011-1098
CVE STATUS: Patched
CVE SUMMARY: Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
CVSS v2 BASE SCORE: 1.9
CVSS v3 BASE SCORE: 0.0
CVSS v4 BASE SCORE: 0.0
VECTOR: LOCAL
VECTORSTRING: AV:L/AC:M/Au:N/C:P/I:N/A:N
MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2011-1098

LAYER: meta
PACKAGE NAME: logrotate
PACKAGE VERSION: 3.21.0
CVE: CVE-2011-1154
CVE STATUS: Patched
CVE SUMMARY: The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
CVSS v2 BASE SCORE: 6.9
CVSS v3 BASE SCORE: 0.0
CVSS v4 BASE SCORE: 0.0
VECTOR: LOCAL
VECTORSTRING: AV:L/AC:M/Au:N/C:C/I:C/A:C
MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2011-1154

LAYER: meta
PACKAGE NAME: logrotate
PACKAGE VERSION: 3.21.0
CVE: CVE-2011-1155
CVE STATUS: Patched
CVE SUMMARY: The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
CVSS v2 BASE SCORE: 1.9
CVSS v3 BASE SCORE: 0.0
CVSS v4 BASE SCORE: 0.0
VECTOR: LOCAL
VECTORSTRING: AV:L/AC:M/Au:N/C:N/I:N/A:P
MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2011-1155

LAYER: meta
PACKAGE NAME: logrotate
PACKAGE VERSION: 3.21.0
CVE: CVE-2011-1548
CVE STATUS: Ignored
CVE DETAIL: not-applicable-platform
CVE DESCRIPTION: CVE is debian, gentoo or SUSE specific on the way logrotate was installed/used
CVE SUMMARY: The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.
CVSS v2 BASE SCORE: 6.3
CVSS v3 BASE SCORE: 0.0
CVSS v4 BASE SCORE: 0.0
VECTOR: LOCAL
VECTORSTRING: AV:L/AC:M/Au:N/C:N/I:C/A:C
MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2011-1548

LAYER: meta
PACKAGE NAME: logrotate
PACKAGE VERSION: 3.21.0
CVE: CVE-2011-1549
CVE STATUS: Ignored
CVE DETAIL: not-applicable-platform
CVE DESCRIPTION: CVE is debian, gentoo or SUSE specific on the way logrotate was installed/used
CVE SUMMARY: The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories under /var/log/ for packages.
CVSS v2 BASE SCORE: 6.3
CVSS v3 BASE SCORE: 0.0
CVSS v4 BASE SCORE: 0.0
VECTOR: LOCAL
VECTORSTRING: AV:L/AC:M/Au:N/C:N/I:C/A:C
MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2011-1549

LAYER: meta
PACKAGE NAME: logrotate
PACKAGE VERSION: 3.21.0
CVE: CVE-2011-1550
CVE STATUS: Ignored
CVE DETAIL: not-applicable-platform
CVE DESCRIPTION: CVE is debian, gentoo or SUSE specific on the way logrotate was installed/used
CVE SUMMARY: The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories for the (1) cobbler, (2) inn, (3) safte-monitor, and (4) uucp packages.
CVSS v2 BASE SCORE: 6.3
CVSS v3 BASE SCORE: 0.0
CVSS v4 BASE SCORE: 0.0
VECTOR: LOCAL
VECTORSTRING: AV:L/AC:M/Au:N/C:N/I:C/A:C
MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2011-1550

LAYER: meta
PACKAGE NAME: logrotate
PACKAGE VERSION: 3.21.0
CVE: CVE-2022-1348
CVE STATUS: Patched
CVE SUMMARY: A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
CVSS v2 BASE SCORE: 4.0
CVSS v3 BASE SCORE: 6.5
CVSS v4 BASE SCORE: 0.0
VECTOR: NETWORK
VECTORSTRING: AV:N/AC:L/Au:S/C:N/I:N/A:P
MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2022-1348