libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4845-1 advisory.

  - libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured     umask, leading to disclosure of information. (CVE-2018-14348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2047 advisory.

  - libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured     umask, leading to disclosure of information. (CVE-2018-14348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libcgroup package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - libcgroup up to and including 0.41 creates     /var/log/cgred with mode 0666 regardless of the     configured umask, leading to disclosure of     information.(CVE-2018-14348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libcgroup packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - libcgroup up to and including 0.41 creates     /var/log/cgred with mode 0666 regardless of the     configured umask, leading to disclosure of     information.(CVE-2018-14348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libcgroup packages installed that are affected by a vulnerability:

  - libcgroup up to and including 0.41 creates     /var/log/cgred with mode 0666 regardless of the     configured umask, leading to disclosure of information.
    (CVE-2018-14348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libcgroup packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libcgroup up to and including 0.41 creates     /var/log/cgred with mode 0666 regardless of the     configured umask, leading to disclosure of     information.(CVE-2018-14348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information.(CVE-2018-14348)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libcgroup packages installed that are affected by a vulnerability:

  - libcgroup up to and including 0.41 creates     /var/log/cgred with mode 0666 regardless of the     configured umask, leading to disclosure of information.
    (CVE-2018-14348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libcgroup packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - libcgroup up to and including 0.41 creates     /var/log/cgred with mode 0666 regardless of the     configured umask, leading to disclosure of     information.(CVE-2018-14348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for libcgroup is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libcgroup packages provide tools and libraries to control and monitor control groups.

Security Fix(es) :

* libcgroup: cgrulesengd creates log files with insecure permissions (CVE-2018-14348)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - libcgroup: cgrulesengd creates log files with insecure     permissions (CVE-2018-14348)

Fix for **CVE-2018-14348**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libcgroup fixes the following issues: Security issue fixed :

  - CVE-2018-14348: Fix daemon that creates /var/log/cgred     with mode 0666 (bsc#1100365). This updates also sets the     permissions of already existing log files to proper     values.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The cgrulesengd daemon in libcgroup creates log files with world readable and writable permissions due to a reset of the file mode creation mask (umask(0)).

For Debian 8 'Jessie', this problem has been fixed in version 0.41-6+deb8u1.

We recommend that you upgrade your libcgroup packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libcgroup fixes the following issues :

The following security vulnerability was fixed :

  - CVE-2018-14348: Fixed a permission issue with     /var/log/cgred. The permissions were not restrictive     enough beforehand and ignored any umask setting.
    (boo#1100365)

This update for libcgroup fixes the following issues: Security issue fixed :

  - CVE-2018-14348: Fix daemon that creates /var/log/cgred     with mode 0666 (bsc#1100365).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libcgroup1 fixes the following issues: Security issue fixed :

  - CVE-2018-14348: Fix daemon that creates /var/log/cgred     with mode 0666 (bsc#1100365).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183118	Ubuntu 16.04 ESM / 18.04 ESM : libcgroup vulnerability (USN-4845-1)	Nessus	Ubuntu Local Security Checks	high
180835	Oracle Linux 7 : libcgroup (ELSA-2019-2047)	Nessus	Oracle Linux Local Security Checks	high
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	critical
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	critical
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	critical
141718	EulerOS Virtualization 3.0.2.2 : libcgroup (EulerOS-SA-2020-2192)	Nessus	Huawei Local Security Checks	high
137950	EulerOS Virtualization 3.0.6.0 : libcgroup (EulerOS-SA-2020-1731)	Nessus	Huawei Local Security Checks	high
132471	NewStart CGSL CORE 5.05 / MAIN 5.05 : libcgroup Vulnerability (NS-SA-2019-0235)	Nessus	NewStart CGSL Local Security Checks	high
131665	EulerOS 2.0 SP2 : libcgroup (EulerOS-SA-2019-2512)	Nessus	Huawei Local Security Checks	high
130232	Amazon Linux 2 : libcgroup (ALAS-2019-1336)	Nessus	Amazon Linux Local Security Checks	high
129907	NewStart CGSL CORE 5.04 / MAIN 5.04 : libcgroup Vulnerability (NS-SA-2019-0186)	Nessus	NewStart CGSL Local Security Checks	high
129194	EulerOS 2.0 SP3 : libcgroup (EulerOS-SA-2019-2001)	Nessus	Huawei Local Security Checks	high
128956	EulerOS Virtualization for ARM 64 3.0.2.0 : libcgroup (EulerOS-SA-2019-1953)	Nessus	Huawei Local Security Checks	high
128841	EulerOS 2.0 SP5 : libcgroup (EulerOS-SA-2019-1918)	Nessus	Huawei Local Security Checks	high
128338	CentOS 7 : libcgroup (CESA-2019:2047)	Nessus	CentOS Local Security Checks	high
128229	Scientific Linux Security Update : libcgroup on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	high
127657	RHEL 7 : libcgroup (RHSA-2019:2047)	Nessus	Red Hat Local Security Checks	high
120917	Fedora 28 : libcgroup (2018-f6adf1cb62)	Nessus	Fedora Local Security Checks	high
112056	SUSE SLED12 / SLES12 Security Update : libcgroup (SUSE-SU-2018:2468-1)	Nessus	SuSE Local Security Checks	high
112048	Debian DLA-1472-1 : libcgroup security update	Nessus	Debian Local Security Checks	high
111586	openSUSE Security Update : libcgroup (openSUSE-2018-821)	Nessus	SuSE Local Security Checks	high
111505	SUSE SLED12 / SLES12 Security Update : libcgroup (SUSE-SU-2018:2143-1)	Nessus	SuSE Local Security Checks	high
111504	SUSE SLES11 Security Update : libcgroup1 (SUSE-SU-2018:2142-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-14348

high

Tenable Plugins

high

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high