A security issue in logrotate was apparently made public today (May 25): https://www.openwall.com/lists/oss-security/2022/05/25/3 There should be multiple patches upstream to address it, and a new release possibly coming soon. Mageia 8 is also affected.
Indeed 3.20.1 is now released, fixing this. Cauldron should be updated. Commits to apply to Mageia 8 are linked in the message below: https://www.openwall.com/lists/oss-security/2022/05/25/5
Status comment: (none) => Fixed upstream in 3.20.1
Whiteboard: (none) => MGA8TOO
Ubuntu has issued an advisory for this today (May 26): https://ubuntu.com/security/notices/USN-5447-1
Severity: normal => major
'logrotate' has been committed by various people, so assigning this update globally.
Assignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated package fixes a security vulnerability: A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0. (CVE-2022-1348) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1348 https://www.openwall.com/lists/oss-security/2022/05/25/3 https://www.openwall.com/lists/oss-security/2022/05/25/5 https://ubuntu.com/security/notices/USN-5447-1 ======================== Updated packages in core/updates_testing: ======================== logrotate-3.17.0-3.1.mga8 from SRPM: logrotate-3.17.0-3.1.mga8.src.rpm
Whiteboard: MGA8TOO => (none)Assignee: pkg-bugs => qa-bugsStatus comment: Fixed upstream in 3.20.1 => (none)Status: NEW => ASSIGNEDVersion: Cauldron => 8CVE: (none) => CVE-2022-1348CC: (none) => nicolas.salguero
Fedora has issued an advisory for this on May 28: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZYEB4F37BY6GLEJKP2EPVAVQ6TA3HQKR/
# dnf list logrotate Last metadata expiration check: 0:09:43 ago on Thu 02 Jun 2022 03:43:56 PM -03. Installed Packages logrotate.x86_64 3.17.0-3.1.mga8 @updates_testing-x86_64 Invoked # logrotate -l=logr.log //etc/logrotate.conf No errors reported. Ulrich Beckmann
CC: (none) => bequimao.de
(In reply to Nicolas Salguero from comment #4) > Suggested advisory: > ======================== > > The updated package fixes a security vulnerability: > > A vulnerability was found in logrotate in how the state file is created. The > state file is used to prevent parallel executions of multiple instances of > logrotate by acquiring and releasing a file lock. When the state file does > not exist, it is created with world-readable permission, allowing an > unprivileged user to lock the state file, stopping any rotation. This flaw > affects logrotate versions before 3.20.0. (CVE-2022-1348) > > References: > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1348 > https://www.openwall.com/lists/oss-security/2022/05/25/3 > https://www.openwall.com/lists/oss-security/2022/05/25/5 > https://ubuntu.com/security/notices/USN-5447-1 > ======================== > > Updated packages in core/updates_testing: > ======================== > logrotate-3.17.0-3.1.mga8 > > from SRPM: > logrotate-3.17.0-3.1.mga8.src.rpm Version no. 3.17. still contains the flaw. Why is the upgrade needed? Ulrich
The fix is backported as a patches. https://svnweb.mageia.org/packages/updates/8/logrotate/current/SOURCES/CVE-2022-1348-1.patch?revision=1860848&view=markup https://svnweb.mageia.org/packages/updates/8/logrotate/current/SOURCES/CVE-2022-1348-2.patch?revision=1860848&view=markup The change in permission isn't applied until it's run for the first time after installing the update. [root@x8v ~]# ll /var/lib/logrotate.status -rw-r--r-- 1 root root 718 May 19 17:45 /var/lib/logrotate.status [root@x8v ~]# urpmi logrotate installing logrotate-3.17.0-3.1.mga8.x86_64.rpm from //root/qa-testing/x86_64 Preparing... ####################################################################################################################################################################################################### 1/1: logrotate ####################################################################################################################################################################################################### 1/1: removing logrotate-3.17.0-3.mga8.x86_64 ####################################################################################################################################################################################################### [root@x8v ~]# ll /var/lib/logrotate.status -rw-r--r-- 1 root root 718 May 19 17:45 /var/lib/logrotate.status [root@x8v ~]# /etc/cron.daily/logrotate [root@x8v ~]# ll /var/lib/logrotate.status -rw-r----- 1 root root 714 Jun 2 16:07 /var/lib/logrotate.status
CC: (none) => davidwhodgins
Keywords: (none) => validated_updateWhiteboard: (none) => MGA8-64-OKCC: (none) => sysadmin-bugs
Keywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0217.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED