CVE-2017-14178

Published: Feb 2, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.

Affected (1)

Products: Snapcraft: Snapd

Snapcraft

1 product

Snapd

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Snapcraft Snapd	From 2.27 to 2.29.2

Related CWEs

CWE-755

Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

References (6)

https://github.com/snapcore/snapd/pull/4194

Source: security@ubuntu.com

Issue TrackingThird Party Advisory

https://launchpad.net/bugs/1730255

Source: security@ubuntu.com

Issue TrackingPatch

https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14178.html

Source: security@ubuntu.com

PatchVendor Advisory

https://github.com/snapcore/snapd/pull/4194

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://launchpad.net/bugs/1730255

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14178.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.