Description
The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | logrotate | 3.8.0-1 | — |
| Debian 13 | logrotate | 3.8.0-1 | — |
| Debian 12 | logrotate | 3.8.0-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | logrotate | 3.7.8-12.el6_0.1 | RHSA-2011:0407 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | logrotate | 3.10.0-4.1 | openSUSE-SU-2024:10231-1 |
Advisories 2
- RHSA-2011:0407 Red Hat Security Advisory: logrotate security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10231-1 logrotate-3.10.0-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110310 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110308 Re: CVE Request -- logrotate -- nine issues mailing-list
- 43955 third-party-advisory
- [oss-security] 20110307 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- ADV-2011-0961 vdb-entry
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=680796
- [oss-security] 20110311 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110306 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110307 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110305 Re: CVE Request -- logrotate -- nine issues mailing-list
- FEDORA-2011-3739 vendor-advisory
- [oss-security] 20110305 Re: CVE Request -- logrotate -- nine issues mailing-list
- ADV-2011-0791 vdb-entry
- MDVSA-2011:065 vendor-advisory
- [oss-security] 20110307 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110323 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110306 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- FEDORA-2011-3758 vendor-advisory
- [oss-security] 20110310 Re: CVE Request -- logrotate -- nine issues mailing-list
- RHSA-2011:0407 vendor-advisory
- [oss-security] 20110311 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110311 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110306 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110311 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- ADV-2011-0872 vdb-entry
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110314 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110306 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110306 Re: CVE Request -- logrotate -- nine issues mailing-list
- [oss-security] 20110305 Re: CVE Request -- logrotate -- nine issues mailing-list