Bug 2376353 (CVE-2025-49809)
| Summary: | CVE-2025-49809 mtr: From CVEorg collector | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | adudiak, kshier, msekleta, omaciel, redhat-bugzilla, stcannon, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A possible privilege escalation flaw was found in the MTR networking tool. This issue occurs in rare cases when the package is configured to run with sudo rules instead of setuid and stems from its improper handling in the execution of a program specified by the MTR_PACKET environment variable.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2376431, 2376430 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2025-07-04 13:01:13 UTC
Note that we have closed all RHEL trackers for this as NOTABUG because RHEL versions of mtr are not affected to begin with and proposed fix doesn't apply to mtr in RHEL context (i.e. no custom mtr sudo rules are needed). |