Description
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | abrt +21 | 2.10.9-26.el8_10 | RHSA-2026:54272 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.8 TUS | abrt +21 | 2.10.9-25.el8_8.2 | RHSA-2026:69117 |
| RHEL 8.8 E4S | abrt +21 | 2.10.9-25.el8_8.2 | RHSA-2026:69117 |
| RHEL 8.6 EUS Long Life | abrt +21 | 2.10.9-25.el8_6.2 | RHSA-2026:69115 |
| RHEL 8.6 AUS | abrt +21 | 2.10.9-25.el8_6.2 | RHSA-2026:69115 |
| RHEL 8.4 EUS Long Life | abrt +21 | 2.10.9-25.el8_4.2 | RHSA-2026:69116 |
| RHEL 8.4 AUS | abrt +21 | 2.10.9-25.el8_4.2 | RHSA-2026:69116 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | abrt +21 | 2.10.9-26.el8_10.alma.1 | ALSA-2026:54272 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | abrt | 2.10.9-26.el8_10.rocky.0.1 | RLSA-2026:54272 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libreport | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | abrt +21 | 2.10.9-26.0.2.el8_10 | ELSA-2026-54272 |
Advisories 8
- RHSA-2026:69115 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALSA-2026:54272 Important: abrt security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-3470 Red Hat Enterprise Linux (abrt): Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Sep 27, 2026
- RHSA-2026:69117 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2026:69116 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2026:54272 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- ELSA-2026-54272 Important: abrt security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
- RLSA-2026:54272 Important: abrt security update Rocky Linux Security Advisories · Aug 13, 2026
References
- RHSA-2026:54272 vendor-advisory
- RHSA-2026:69115 vendor-advisory
- RHSA-2026:69116 vendor-advisory
- RHSA-2026:69117 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-54231 vdb-entry
- RHBZ#2488571 issue-tracking