Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Canonical REAR may expose data via readable initrd
published 1 day ago
Summary
The REAR (Relax-and-Recover) backup tool can create a file that is readable by anyone on the system when a certain rescue option is turned on. This could let someone with local access view sensitive information. Update the software or disable the rescue setting to stop the file from being world‑readable.
What to do
- Update canonical rear to version 2.3+dfsg-1ubuntu0.1~esm1.
- Update canonical rear to version 2.5+dfsg-1ubuntu0.1~esm1.
- Update canonical rear to version 2.6+dfsg-1+deb11u1build0.22.04.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:18.04:LTS | canonical | rear |
< 2.3+dfsg-1ubuntu0.1~esm1 Fix: upgrade to 2.3+dfsg-1ubuntu0.1~esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | rear |
< 2.5+dfsg-1ubuntu0.1~esm1 Fix: upgrade to 2.5+dfsg-1ubuntu0.1~esm1
|
| Ubuntu:22.04:LTS | canonical | rear |
< 2.6+dfsg-1+deb11u1build0.22.04.1 Fix: upgrade to 2.6+dfsg-1+deb11u1build0.22.04.1
|
Original advisory text
rear vulnerability
It was discovered that Relax-and-Recover created a world-readable initrd
when GRUB_RESCUE was enabled. A local attacker could possibly use this
issue to obtain sensitive information.
when GRUB_RESCUE was enabled. A local attacker could possibly use this
issue to obtain sensitive information.
References
- https://ubuntu.com/security/notices/USN-8988-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-23301 Third Party Advisory
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
USN-8988-1 · OSV
Track software like this
Free during beta