CVE-2018-19638: User can overwrite arbitrary log files in support tar
Published Mar 5, 2019
·Updated
In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.
Affected Software
1 affected component
openSUSE Supportutils<3.1-5.7.1
Event History
Mar 5, 2019
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2018-19638.
2
What is the severity of CVE-2018-19638?
The severity of CVE-2018-19638 is medium with a value of 4.7.
3
What is the affected software of CVE-2018-19638?
The affected software is Opensuse Supportutils version up to 3.1-5.7.1.
4
How can an unprivileged user exploit CVE-2018-19638?
An unprivileged user could exploit CVE-2018-19638 by overwriting arbitrary files in the directory used by supportutils to collect log files.
5
Is there a fix available for CVE-2018-19638?
Yes, a fix is available for CVE-2018-19638. Users should update to supportutils version 3.1-5.7.1 or later.