Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

  1. Reconshell
  2. Vulnerabilities (CVE)
Filtered by vendor Groonga Subscribe
Filtered by product Groonga-httpd
Total 1 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-11675 1 Groonga 1 Groonga-httpd 2019-05-03 6.9 MEDIUM 7.0 HIGH
The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.