CVE-2023-31437

low-risk

Published 2023-06-13

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

Do I need to act?

0.17% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Systemd

Affected Vendors

Systemd Project

References (6)

Third Party Advisory https://github.com/kastel-security/Journald

Technical Description https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf

Release Notes https://github.com/systemd/systemd/releases

Third Party Advisory https://github.com/kastel-security/Journald

Technical Description https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf

Release Notes https://github.com/systemd/systemd/releases

/ 100

low-risk

Severity 21/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal