CVE-2022-1348

Name of the Vulnerable Software and Affected Versions logrotate versions prior to 3.20.0

Description A flaw was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation.

Recommendations For logrotate versions prior to 3.20.0, update to version 3.20.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the state file to prevent unprivileged users from locking it.