The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands…

published 2011-03-30 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1167

cvss: 6.9; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits: 0; none known

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

Patch / fix

distros 3 links 3

debian red hat opensuse

logrotate Debian 14, Debian 13, Debian 12 3.8.0-1

debian advisories DEBIAN-CVE-2011-1154

logrotate RHEL 6 3.7.8-12.el6_0.1

red hat advisories RHSA-2011:0407

logrotate openSUSE Tumbleweed 3.10.0-4.1

opensuse advisories openSUSE-SU-2024:10231-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-1154 updated 2026-11-07 cvss 6.9

logrotate: Shell command injection by using the shred configuration directive

Red Hat Enterprise Linux Desktop (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux HPC Node (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux Server (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux Workstation (v. 6) logrotate 3.7.8-12.el6_0.1
fixed: vendor fix RHSA-2011:0407
Red Hat Enterprise Linux 4 logrotate Red Hat Enterprise Linux 5 logrotate
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-20 Improper Input Validation

References

lists.fedoraproject.org /pipermail/package-announce/2011-March/056992.html
vendor-advisory, patch
bugzilla.redhat.com /show_bug.cgi?id=680796
patch
openwall.com /lists/oss-security/2011/03/07/11
mailing-list, patch
lists.fedoraproject.org /pipermail/package-announce/2011-April/057845.html
vendor-advisory
mandriva.com /security/advisories?name=MDVSA-2011:065
vendor-advisory
redhat.com /support/errata/RHSA-2011-0407.html
vendor-advisory
vupen.com /english/advisories/2011/0791
vdb-entry, vendor-advisory
openwall.com /lists/oss-security/2011/03/04/19
mailing-list
openwall.com /lists/oss-security/2011/03/04/16
mailing-list
openwall.com /lists/oss-security/2011/03/04/25
mailing-list
openwall.com /lists/oss-security/2011/03/04/30
mailing-list
openwall.com /lists/oss-security/2011/03/04/26
mailing-list
openwall.com /lists/oss-security/2011/03/10/3
mailing-list
openwall.com /lists/oss-security/2011/03/04/28
mailing-list
openwall.com /lists/oss-security/2011/03/08/5
mailing-list
secunia.com /advisories/43955
third-party-advisory
openwall.com /lists/oss-security/2011/03/07/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/31
mailing-list
vupen.com /english/advisories/2011/0961
vdb-entry
openwall.com /lists/oss-security/2011/03/04/17
mailing-list
openwall.com /lists/oss-security/2011/03/10/6
mailing-list
openwall.com /lists/oss-security/2011/03/06/3
mailing-list
openwall.com /lists/oss-security/2011/03/04/29
mailing-list
openwall.com /lists/oss-security/2011/03/07/6
mailing-list
openwall.com /lists/oss-security/2011/03/05/6
mailing-list
openwall.com /lists/oss-security/2011/03/05/4
mailing-list
openwall.com /lists/oss-security/2011/03/23/11
mailing-list
openwall.com /lists/oss-security/2011/03/06/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/18
mailing-list
openwall.com /lists/oss-security/2011/03/10/2
mailing-list
openwall.com /lists/oss-security/2011/03/11/3
mailing-list
openwall.com /lists/oss-security/2011/03/10/7
mailing-list
openwall.com /lists/oss-security/2011/03/05/8
mailing-list
openwall.com /lists/oss-security/2011/03/04/22
mailing-list
openwall.com /lists/oss-security/2011/03/11/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/27
mailing-list
vupen.com /english/advisories/2011/0872
vdb-entry
openwall.com /lists/oss-security/2011/03/04/32
mailing-list
openwall.com /lists/oss-security/2011/03/14/26
mailing-list
openwall.com /lists/oss-security/2011/03/04/24
mailing-list
openwall.com /lists/oss-security/2011/03/04/33
openwall.com /lists/oss-security/2011/03/06/4
openwall.com /lists/oss-security/2011/03/06/6

Sources

CVE List CVE-2011-1154
NVD CVE-2011-1154

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary