Vulnerability in Snapcraft Snapd
CVE-2017-14178
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.
EPSS: 0.018 (75.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Snapcraft Snapd
- N/a Snapd — versions 2.27 through 2.29.2
Weakness classification (CWE)
References
- security@ubuntu.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security@ubuntu.com (x_refsource_CONFIRM, Patch, Issue Tracking)
- security@ubuntu.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2017-14178?
- CVE-2017-14178 is a high-severity vulnerability in Snapcraft Snapd, classified under Improper Handling of Exceptional Conditions. CVSS score: 7.5/10. Published 2018-02-02.
- How severe is CVE-2017-14178?
- High severity. CVSS v3 base score is 7.5 out of 10.