CVE-2020-8019: syslog-ng: Local privilege escalation from new to root in %post

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-06-29 · updated 2026-06-17
Weakness: CWE-61

Description

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SUSE Linux Enterprise Debuginfo 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Debuginfo 11-SP4 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Module for Legacy Software 12 syslog-ng versions prior to 3.6.4-12.8.1. SUSE Linux Enterprise Point of Sale 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server 11-SP4-LTSS syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server for SAP 12-SP1 syslog-ng versions prior to 3.6.4-12.8.1. openSUSE Backports SLE-15-SP1 syslog-ng versions prior to 3.19.1-bp151.4.6.1. openSUSE Leap 15.1 syslog-ng versions prior to 3.19.1-lp151.3.6.1.

Affected products

OneIdentity Syslog-Ng: before 2.0.9-27.34.40.5.1; before 3.6.4-12.8.1; before 3.19.1-bp151.4.6.1; before 3.19.1-lp151.3.6.1 — fixed in 2.0.9-27.34.40.5.1, 3.19.1-bp151.4.6.1, 3.19.1-lp151.3.6.1, 3.6.4-12.8.1

How to fix

Upgrade to a fixed version: OneIdentity Syslog-Ng 2.0.9-27.34.40.5.1, 3.19.1-bp151.4.6.1, 3.19.1-lp151.3.6.1, 3.6.4-12.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8019 or the next vulnerability affects your stack