CVE-2024-49368 Unchecked logrotate settings lead to arbitrary command execution

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...

CVE-2024-49368

CVE-2024-49368 affects Nginx UI prior to version 2.0.0-beta.36. The issue arises when configuring logrotate: unverified input is passed to exec.Command, allowing arbitrary command execution. The fixed version is 2.0.0-beta.36. This is documented across multiple sources (Red Hat, NVD, CVE lists, a...

CVE-2024-49368 Unchecked logrotate settings lead to arbitrary command execution

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...

CVE-2024-49368 Unchecked logrotate settings lead to arbitrary command execution

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...

Nginx UI 输入验证错误漏洞

Nginx UI is a WebUI for Nginx by Jacky Personal Developer. An input validation error vulnerability exists in versions of Nginx UI prior to 2.0.0-beta.36, which stems from a failure to validate input when configuring logrotate, leading to arbitrary command execution...

PT-2024-7289 · Nginx · Nginx-Ui

Name of the Vulnerable Software and Affected Versions: Nginx UI versions prior to 2.0.0-beta.36 Description: The issue is related to the Nginx UI's configuration of logrotate, where it does not verify input and directly passes it to exec.Command, causing arbitrary command execution. This allows a...

RHSA-2022:8393 Red Hat Security Advisory: logrotate security update

Bulletin has no description...

RHSA-2011:0407 Red Hat Security Advisory: logrotate security update

Bulletin has no description...

Virtuozzo Hybrid Infrastructure 6.2 (6.2.0-136)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover the compute service, high availability of the management node, object storage management, networking, and monitoring. Additionally, this release delivers stability improvements and addresses issues found ...

OPENSUSE-SU-2024:12108-1 logrotate-3.20.1-1.1 on GA media

These are all security issues fixed in the logrotate-3.20.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10231-1 logrotate-3.10.0-4.1 on GA media

These are all security issues fixed in the logrotate-3.10.0-4.1 package on the GA media of openSUSE Tumbleweed...

RHEL 5 : logrotate (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - logrotate: TOCTOU race condition by creation of new files between opening the file and moment, final...

RHEL 4 : logrotate (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - logrotate: TOCTOU race condition by creation of new files between opening the file and moment, final...

RHEL 6 : freeradius (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - freeradius: privilege escalation due to insecure logrotate configuration CVE-2019-10143 - freeradius:...

openSUSE: Security Advisory for logrotate (SUSE-SU-2022:2547-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rocky Linux 9 : logrotate (RLSA-2022:8393)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8393 advisory. - A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrota...

Oracle Linux 8 : freeradius:3.0 (ELSA-2019-3353)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3353 advisory. - It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of t...

logrotate bug fix and enhancement update

An update is available for logrotate. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9....

Moderate Photon OS Security Update - PHSA-2023-4.0-0349

Updates of 'logrotate' packages of Photon OS have been released...

SUSE-SU-2023:0592-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: cobbler: - Fix improper authorization bsc1197027, CVE-2022-0860 - Prevent error when starting up logrotate.service bsc1188191 drools: - Deserialization of Untrusted Data: unsafe data deserialization in DroolsStreamUtils.java bsc1204879, CVE-2022-1415...