high7.5
CVE-2017-14178
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated…
Impact
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Snapcraft | Snapd | from 2.27 through 2.29.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/snapcore/snapd/pull/4194
- https://launchpad.net/bugs/1730255
- https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14178.html
- https://github.com/snapcore/snapd/pull/4194
- https://launchpad.net/bugs/1730255
- https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14178.html