CVE-2017-14178: High severity Snapcraft Snapd vulnerability
Published Feb 2, 2018
·Updated
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.
Affected Software
2 affected componentsFixes available
Snapcraft Snapd>=2.27<=2.29.2
debian/snapd
2.49-1+deb11u22.57.6-12.68.3-32.71-32.72-1
Remediation
Patch Available
Event History
Feb 2, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Data Sourced
via NVD·02:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:10 PM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·08:56 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·08:56 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-14178?
CVE-2017-14178 is classified as a medium severity vulnerability due to its potential for unprivileged access to system logs.
2
How does CVE-2017-14178 affect unprivileged users?
CVE-2017-14178 allows unprivileged, unauthenticated users to bypass systemd-journald's access restrictions and view logs.
3
What versions of snapd are affected by CVE-2017-14178?
CVE-2017-14178 affects snapd versions from 2.27 through 2.29.2.
4
How do I fix CVE-2017-14178?
To mitigate CVE-2017-14178, update snapd to version 2.49-1+deb11u2 or later.
5
Is CVE-2017-14178 a common vulnerability?
CVE-2017-14178 is a known vulnerability in snapd and has been addressed in subsequent software updates.