CVE-2025-53882

The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess

View on CVE.org

Published Jul 23, 2025 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Description

A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SUSE

openSUSE Tumbleweed

unaffected

Version	Status	Constraints
`?`	affected	< 3.3.10-2.1

No data.

Vendor	Product	Versions
Suse	Opensuse Tumbleweed	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-22438	A Improper Check for Dropped Privileges vulnerability in the logrotate setup of openSUSE Tumbleweed mailman3 allows the mailman user to create files as root, allowing for a potential privilege escalation. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.147% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53882

History

Sep 3, 2025 8:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-273

Sep 3, 2025 7:30 AM Description updated. Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Description	A Improper Check for Dropped Privileges vulnerability in the logrotate setup of openSUSE Tumbleweed mailman3 allows the mailman user to create files as root, allowing for a potential privilege escalation. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.	A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.
Title	python-mailman logrotate configuration allows potential escalation from mailman to root	The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess
Weaknesses		CWE-807

Jul 31, 2025 12:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-807

Jul 31, 2025 11:45 AM Description updated. Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSEs mailman3 package allows potential escalation from mailman to root. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.	A Improper Check for Dropped Privileges vulnerability in the logrotate setup of openSUSE Tumbleweed mailman3 allows the mailman user to create files as root, allowing for a potential privilege escalation. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.
Title	python-mailmans logrotate configuration allows potential escalation from mailman to root	python-mailman logrotate configuration allows potential escalation from mailman to root
Weaknesses		CWE-273
Metrics	cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`	cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}` cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}`

Jul 24, 2025 7:00 AM Description updated View changes

Type	Values Removed	Values Added
Description	A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSEs mailman3 package allows potential escalation from mailman to rootThis issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.	A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSEs mailman3 package allows potential escalation from mailman to root. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.

Jul 23, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 23, 2025 5:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Suse Suse opensuse Tumbleweed
Vendors & Products		Suse Suse opensuse Tumbleweed

Jul 23, 2025 9:45 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSEs mailman3 package allows potential escalation from mailman to rootThis issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.
Title		python-mailmans logrotate configuration allows potential escalation from mailman to root
Weaknesses		CWE-807
References		https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53882