CVE-2023-31437

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-31437
An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/kastel-security/Journald Third Party Advisory
https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf Technical Description
https://github.com/systemd/systemd/releases Release Notes
https://github.com/kastel-security/Journald Third Party Advisory
https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf Technical Description
https://github.com/systemd/systemd/releases Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:systemd_project:systemd:253:-:*:*:*:*:*:*
History

21 Nov 2024, 08:01

Type Values Removed Values Added
References () https://github.com/kastel-security/Journald - Third Party Advisory () https://github.com/kastel-security/Journald - Third Party Advisory
References () https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf - Technical Description () https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf - Technical Description
References () https://github.com/systemd/systemd/releases - Release Notes () https://github.com/systemd/systemd/releases - Release Notes

07 Nov 2023, 04:14

Type Values Removed Values Added
Summary ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

23 Jun 2023, 19:16

Type Values Removed Values Added
References (MISC) https://github.com/kastel-security/Journald - (MISC) https://github.com/kastel-security/Journald - Third Party Advisory
References (MISC) https://github.com/systemd/systemd/releases - (MISC) https://github.com/systemd/systemd/releases - Release Notes
References (MISC) https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf - (MISC) https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf - Technical Description
First Time Systemd Project
Systemd Project systemd
CWE CWE-354
CPE cpe:2.3:a:systemd_project:systemd:253:-:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

14 Jun 2023, 12:15

Type Values Removed Values Added
Summary An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. ** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

13 Jun 2023, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-13 17:15

Updated : 2025-01-03 20:15

NVD link : CVE-2023-31437

Mitre link : CVE-2023-31437

CVE.ORG link : CVE-2023-31437

JSON object : View

Products Affected

systemd_project

  • systemd
CWE
CWE-354

Improper Validation of Integrity Check Value