Groonga

groonga

1 CVE • 1 product

Products (1)

Click to collapse

Toggle

Groonga Httpd

groonga-httpd

1 CVE

CVEs (1)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-11675 1Groonga 1Groonga Httpd Jun 17, 2026 May 2, 2019 N/A· v4 7.0 HIGH· v3 6.9 MEDIUM· v2 The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attack...Show more The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.Show less

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2019-11675

1Groonga

1Groonga Httpd

Jun 17, 2026

May 2, 2019

N/A· v4

7.0 HIGH· v3

6.9 MEDIUM· v2

The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.Show less