CVE-2019-11675

NameCVE-2019-11675
DescriptionThe groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: local)
Debian Bugs928304

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
groonga (PTS)stretch6.1.5-1vulnerable
buster9.0.0-1+deb10u1fixed
bullseye, sid9.0.6-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
groongasource(unstable)9.0.1-2medium928304
groongasourcebuster9.0.0-1+deb10u1medium

Notes

[stretch] - groonga <no-dsa> (Minor issue, can be fixed via point release)

Search for package or bug name: Reporting problems