CVE-2026-54231

Published: Jun 13, 2026Modified: Aug 26, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.

Affected (5)

Products: Fedoraproject: Fedora · Redhat: Automatic Bug Reporting Tool, Enterprise Linux

Fedoraproject

1 product

Fedora

Redhat

2 products

Automatic Bug Reporting Tool

Enterprise Linux

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 43
Fedoraproject Fedora	Version 44
Redhat Automatic Bug Reporting Tool	All versions
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0

Related CWEs

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (3)

https://access.redhat.com/errata/RHSA-2026:54272

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-54231

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2488571

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.