p PatchFirst

CVE-2017-14178

CVE-2017-14178

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.

CVSS 7.5 · High · EPSS 1.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • snapd

    Versions
    • 2.27 through 2.29.2: Affected

    No fix published

  • snapd Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.30-1

    Update to 2.30-1

  • snapd Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.30-1

    Update to 2.30-1

  • snapd Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.30-1

    Update to 2.30-1

  • snapd Ubuntu:14.04:LTS

    Versions
    • 2.21~14.04.2
    • 2.22.2~14.04
    • 2.22.3~14.04
    • 2.22.6~14.04
    • 2.23.1~14.04
    • 2.24.1~14.04
    • 2.25~14.04
    • 2.26.10~14.04
    • 2.27.5~14.04
    • 2.28.5~14.04
    Affected ranges
    • ECOSYSTEM: < 2.29.4.2~14.04

    Update to 2.29.4.2~14.04

  • snapd Ubuntu:16.04:LTS

    Versions
    • 1.9
    • 1.9.1.1
    • 1.9.2
    • 2.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.5
    • 2.0.8
    • 2.0.9
    • 2.0.10
    • 2.11+0.16.04
    • 2.12+0.16.04
    • 2.13
    • 2.14.2~16.04
    • 2.15.2ubuntu1
    • 2.16ubuntu3
    • 2.17.1ubuntu1
    • 2.20.1ubuntu1
    • 2.21
    • 2.22.2
    • 2.22.3
    • 2.22.6
    • 2.23.1
    • 2.24.1
    • 2.25
    • 2.26.10
    • 2.27.5
    • 2.28.5
    Affected ranges
    • ECOSYSTEM: < 2.29.4.2

    Update to 2.29.4.2

Original sources

Check your server →