CVE-2026-54231

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:54272
https://access.redhat.com/security/cve/CVE-2026-54231	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2488571	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:automatic_bug_reporting_tool::::::::
	cpe:2.3:o:fedoraproject:fedora:43:::::::*
	cpe:2.3:o:fedoraproject:fedora:44:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*

History

No history.

Information

Published : 2026-06-13 03:16

Updated : 2026-08-26 20:06

NVD link : CVE-2026-54231

Mitre link : CVE-2026-54231

CVE.ORG link : CVE-2026-54231

JSON object : View

Products Affected

redhat

automatic_bug_reporting_tool
enterprise_linux

fedoraproject

fedora

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2026-54231", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54231", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T21:42:52.155696Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:2.10.9-26.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "abrt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "abrt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "abrt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-13T03:16:21.877", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:54272", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-54231", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488571", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de inyecci\u00f3n de contenido en los scripts del gestor de eventos post-creaci\u00f3n de ABRT en libreport. El script de evento consulta el registro de systemd en busca de entradas de registro que coincidan con el proceso bloqueado y escribe los resultados en archivos en el directorio de volcado sin sanear los caracteres de control incrustados. Un usuario local puede inyectar contenido arbitrario en la salida del registro incrustando caracteres de nueva l\u00ednea en los mensajes de syslog, controlando el contenido que root escribe en los archivos del directorio de volcado."}], "lastModified": "2026-08-26T20:06:00.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:automatic_bug_reporting_tool:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2114BEFD-944F-45A8-B071-8A6B5DBDEDA8"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:43:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1D1BBE5-0886-4D95-9862-16A4C316F70A"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:44:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD1E6B15-C7BF-47E1-8034-501385D7B7DD"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}