Vulnerabilites related to advanced_intrusion_detection_environment_project - advanced_intrusion_detection_environment
CVE-2025-54389 (GCVE-0-2025-54389)
Vulnerability from cvelistv5
Published
2025-08-14 15:53
Modified
2025-08-14 19:26
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-117 - Improper Output Neutralization for Logs
Summary
AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.
References
https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28x_refsource_CONFIRM
https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9x_refsource_MISC
https://github.com/aide/aide/releases/tag/v0.19.2x_refsource_MISC
Impacted products
Vendor Product Version
aide aide Version: < 0.19.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54389",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T18:43:22.879950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T19:26:19.162Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aide",
          "vendor": "aide",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.19.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE.  An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-14T15:53:42.393Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28"
        },
        {
          "name": "https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9"
        },
        {
          "name": "https://github.com/aide/aide/releases/tag/v0.19.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aide/aide/releases/tag/v0.19.2"
        }
      ],
      "source": {
        "advisory": "GHSA-522j-vvx9-gg28",
        "discovery": "UNKNOWN"
      },
      "title": "AIDE improper output neutralization vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54389",
    "datePublished": "2025-08-14T15:53:42.393Z",
    "dateReserved": "2025-07-21T16:12:20.734Z",
    "dateUpdated": "2025-08-14T19:26:19.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-54409 (GCVE-0-2025-54409)
Vulnerability from cvelistv5
Published
2025-08-14 15:52
Modified
2025-08-14 19:55
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-476 - NULL Pointer Dereference
Summary
AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.
References
https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxhx_refsource_CONFIRM
https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135ax_refsource_MISC
https://github.com/aide/aide/releases/tag/v0.19.2x_refsource_MISC
Impacted products
Vendor Product Version
aide aide Version: >= 0.13, < 0.19.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54409",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T18:43:34.955521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T19:55:49.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aide",
          "vendor": "aide",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.13, \u003c 0.19.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-14T15:52:24.069Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh"
        },
        {
          "name": "https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a"
        },
        {
          "name": "https://github.com/aide/aide/releases/tag/v0.19.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aide/aide/releases/tag/v0.19.2"
        }
      ],
      "source": {
        "advisory": "GHSA-79g7-f8rv-jcxh",
        "discovery": "UNKNOWN"
      },
      "title": "AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54409",
    "datePublished": "2025-08-14T15:52:24.069Z",
    "dateReserved": "2025-07-21T23:18:10.279Z",
    "dateUpdated": "2025-08-14T19:55:49.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-45417 (GCVE-0-2021-45417)
Vulnerability from cvelistv5
Published
2022-01-20 00:00
Modified
2024-08-04 04:39
Severity ?
CWE
  • n/a
Summary
AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.
References
https://www.openwall.com/lists/oss-security/2022/01/20/3
http://www.openwall.com/lists/oss-security/2022/01/20/3mailing-list
https://www.debian.org/security/2022/dsa-5051vendor-advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00024.htmlmailing-list
https://www.ipi.fi/pipermail/aide/2022-January/001713.html
https://security.gentoo.org/glsa/202311-07vendor-advisory
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:39:20.711Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2022/01/20/3"
          },
          {
            "name": "[oss-security] 20220120 CVE-2021-45417 - aide (\u003e= 0.13 \u003c= 0.17.3): heap-based buffer overflow vulnerability in base64 functions",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/01/20/3"
          },
          {
            "name": "DSA-5051",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5051"
          },
          {
            "name": "[debian-lts-announce] 20220125 [SECURITY] [DLA 2894-1] aide security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00024.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ipi.fi/pipermail/aide/2022-January/001713.html"
          },
          {
            "name": "GLSA-202311-07",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-07"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T09:06:19.920493",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2022/01/20/3"
        },
        {
          "name": "[oss-security] 20220120 CVE-2021-45417 - aide (\u003e= 0.13 \u003c= 0.17.3): heap-based buffer overflow vulnerability in base64 functions",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/01/20/3"
        },
        {
          "name": "DSA-5051",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5051"
        },
        {
          "name": "[debian-lts-announce] 20220125 [SECURITY] [DLA 2894-1] aide security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00024.html"
        },
        {
          "url": "https://www.ipi.fi/pipermail/aide/2022-January/001713.html"
        },
        {
          "name": "GLSA-202311-07",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202311-07"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-45417",
    "datePublished": "2022-01-20T00:00:00",
    "dateReserved": "2021-12-20T00:00:00",
    "dateUpdated": "2024-08-04T04:39:20.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2025-08-14 16:15
Modified
2025-08-19 19:11
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.
References
security-advisories@github.comhttps://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135aPatch
security-advisories@github.comhttps://github.com/aide/aide/releases/tag/v0.19.2Release Notes
security-advisories@github.comhttps://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxhExploit, Vendor Advisory, Mitigation
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxhExploit, Vendor Advisory, Mitigation
Impacted products
Vendor Product Version
advanced_intrusion_detection_environment_project advanced_intrusion_detection_environment *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "039F8014-AB86-48F2-8231-DE5AEE889903",
              "versionEndExcluding": "0.19.2",
              "versionStartIncluding": "0.13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems."
    },
    {
      "lang": "es",
      "value": "AIDE es un entorno avanzado de detecci\u00f3n de intrusiones. Desde la versi\u00f3n 0.13 hasta la 0.19.1, existe una vulnerabilidad de desreferencia de puntero nulo en AIDE. Un atacante puede bloquear el programa durante la impresi\u00f3n de informes o el listado de bases de datos tras configurar atributos de archivo extendidos con un valor de atributo vac\u00edo o con una clave que contenga una coma. Un usuario local podr\u00eda explotar esto para provocar una denegaci\u00f3n de servicio local. Este problema se ha corregido en la versi\u00f3n 0.19.2. Una soluci\u00f3n alternativa consiste en eliminar el grupo xattrs de las reglas que coinciden con los archivos de los sistemas de archivos afectados."
    }
  ],
  "id": "CVE-2025-54409",
  "lastModified": "2025-08-19T19:11:40.850",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-08-14T16:15:39.397",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/aide/aide/releases/tag/v0.19.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory",
        "Mitigation"
      ],
      "url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory",
        "Mitigation"
      ],
      "url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-01-20 18:15
Modified
2024-11-21 06:32
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2022/01/20/3Exploit, Mailing List, Mitigation, Patch, Third Party Advisory
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2022/01/msg00024.htmlMailing List, Third Party Advisory
cve@mitre.orghttps://security.gentoo.org/glsa/202311-07
cve@mitre.orghttps://www.debian.org/security/2022/dsa-5051Third Party Advisory
cve@mitre.orghttps://www.ipi.fi/pipermail/aide/2022-January/001713.htmlExploit, Mailing List, Mitigation, Patch, Third Party Advisory
cve@mitre.orghttps://www.openwall.com/lists/oss-security/2022/01/20/3Exploit, Mailing List, Mitigation, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/01/20/3Exploit, Mailing List, Mitigation, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/01/msg00024.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202311-07
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5051Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.ipi.fi/pipermail/aide/2022-January/001713.htmlExploit, Mailing List, Mitigation, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.openwall.com/lists/oss-security/2022/01/20/3Exploit, Mailing List, Mitigation, Patch, Third Party Advisory
Impacted products
Vendor Product Version
advanced_intrusion_detection_environment_project advanced_intrusion_detection_environment *
redhat ovirt-node 4.4.10
redhat virtualization_host 4.0
redhat enterprise_linux 6.0
redhat enterprise_linux 7.0
redhat enterprise_linux 8.0
fedoraproject fedora 35
canonical ubuntu_linux 14.04
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 20.04
canonical ubuntu_linux 21.04
canonical ubuntu_linux 21.10
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F326AA97-2E19-4061-A78F-23D0459B5878",
              "versionEndIncluding": "0.17.3",
              "versionStartIncluding": "0.13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:ovirt-node:4.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "C57948E0-99DF-40E4-B285-B0CE225EC45C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB28F9AF-3D06-4532-B397-96D7E4792503",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EF1C1CC-3FAE-4DE3-BC41-E5B14D5721F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAE4D2D0-CEEB-416F-8BC5-A7987DF56190",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow."
    },
    {
      "lang": "es",
      "value": "AIDE versiones anteriores a 0.17.4, permite a usuarios locales obtener privilegios de root por medio de metadatos de archivo dise\u00f1ados (como atributos extendidos de XFS o ACLs de tmpfs), debido a un desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria"
    }
  ],
  "id": "CVE-2021-45417",
  "lastModified": "2024-11-21T06:32:10.810",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-20T18:15:07.640",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/01/20/3"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00024.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://security.gentoo.org/glsa/202311-07"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5051"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.ipi.fi/pipermail/aide/2022-January/001713.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.openwall.com/lists/oss-security/2022/01/20/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/01/20/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/202311-07"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5051"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.ipi.fi/pipermail/aide/2022-January/001713.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.openwall.com/lists/oss-security/2022/01/20/3"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2025-08-14 16:15
Modified
2025-08-19 19:11
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.
References
security-advisories@github.comhttps://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9Patch
security-advisories@github.comhttps://github.com/aide/aide/releases/tag/v0.19.2Release Notes
security-advisories@github.comhttps://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28Exploit, Vendor Advisory, Mitigation
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28Exploit, Vendor Advisory, Mitigation
Impacted products
Vendor Product Version
advanced_intrusion_detection_environment_project advanced_intrusion_detection_environment *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C000F3A-E2E1-4B9D-BB4A-EB0157E3DEBF",
              "versionEndExcluding": "0.19.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE.  An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file."
    },
    {
      "lang": "es",
      "value": "AIDE es un entorno avanzado de detecci\u00f3n de intrusiones. Antes de la versi\u00f3n 0.19.2, exist\u00eda una vulnerabilidad de neutralizaci\u00f3n de salida incorrecta en AIDE. Un atacante pod\u00eda manipular un nombre de archivo malicioso incluyendo secuencias de escape de terminal para ocultar la adici\u00f3n o eliminaci\u00f3n del archivo del informe o manipular la salida del registro. Un usuario local podr\u00eda aprovechar esto para eludir la detecci\u00f3n de archivos maliciosos por parte de AIDE. Adem\u00e1s, la salida de nombres de claves de atributos extendidos y enlaces simb\u00f3licos tampoco se neutraliza correctamente. Este problema se ha corregido en la versi\u00f3n 0.19.2. Una soluci\u00f3n alternativa consiste en configurar AIDE para escribir la salida del informe en un archivo normal, redirigir la salida est\u00e1ndar a un archivo normal o redirigir la salida del registro escrita en la salida est\u00e1ndar a un archivo normal."
    }
  ],
  "id": "CVE-2025-54389",
  "lastModified": "2025-08-19T19:11:20.650",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-08-14T16:15:37.993",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/aide/aide/releases/tag/v0.19.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory",
        "Mitigation"
      ],
      "url": "https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory",
        "Mitigation"
      ],
      "url": "https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}