{
  "threat_severity" : "Moderate",
  "public_date" : "2019-01-09T18:00:00Z",
  "bugzilla" : {
    "description" : "systemd: out-of-bounds read when parsing a crafted syslog message",
    "id" : "1653867",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1653867"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.3",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-125->CWE-200",
  "details" : [ "An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.", "An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data." ],
  "statement" : "This issue affects the versions of systemd as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\nRed Hat Virtualization Hypervisor and Management Appliance include vulnerable versions of systemd. However, since exploitation requires local access and impact is restricted to information disclosure, this flaw is rated as having a security issue of Low. Future updates may address this issue.",
  "acknowledgement" : "Red Hat would like to thank Qualys Research Labs for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Ansible Tower 3.4 for RHEL 7",
    "release_date" : "2020-02-18T00:00:00Z",
    "advisory" : "RHBA-2020:0547",
    "cpe" : "cpe:/a:redhat:ansible_tower:3.4::el7",
    "package" : "ansible-tower-34/ansible-tower-memcached:1.4.15-28"
  }, {
    "product_name" : "Red Hat Ansible Tower 3.4 for RHEL 7",
    "release_date" : "2020-02-18T00:00:00Z",
    "advisory" : "RHBA-2020:0547",
    "cpe" : "cpe:/a:redhat:ansible_tower:3.4::el7",
    "package" : "ansible-tower-35/ansible-tower-memcached:1.4.15-28"
  }, {
    "product_name" : "Red Hat Ansible Tower 3.4 for RHEL 7",
    "release_date" : "2020-02-18T00:00:00Z",
    "advisory" : "RHBA-2020:0547",
    "cpe" : "cpe:/a:redhat:ansible_tower:3.4::el7",
    "package" : "ansible-tower-37/ansible-tower-memcached-rhel7:1.4.15-28"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2019-08-06T00:00:00Z",
    "advisory" : "RHSA-2019:2091",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "systemd-0:219-67.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.4 Advanced Update Support",
    "release_date" : "2020-02-25T00:00:00Z",
    "advisory" : "RHSA-2020:0593",
    "cpe" : "cpe:/o:redhat:rhel_aus:7.4",
    "package" : "systemd-0:219-42.el7_4.20"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.4 Telco Extended Update Support",
    "release_date" : "2020-02-25T00:00:00Z",
    "advisory" : "RHSA-2020:0593",
    "cpe" : "cpe:/o:redhat:rhel_tus:7.4",
    "package" : "systemd-0:219-42.el7_4.20"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions",
    "release_date" : "2020-02-25T00:00:00Z",
    "advisory" : "RHSA-2020:0593",
    "cpe" : "cpe:/o:redhat:rhel_e4s:7.4",
    "package" : "systemd-0:219-42.el7_4.20"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.5 Extended Update Support",
    "release_date" : "2020-04-01T00:00:00Z",
    "advisory" : "RHSA-2020:1264",
    "cpe" : "cpe:/o:redhat:rhel_eus:7.5",
    "package" : "systemd-0:219-57.el7_5.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.6 Extended Update Support",
    "release_date" : "2019-10-29T00:00:00Z",
    "advisory" : "RHSA-2019:3222",
    "cpe" : "cpe:/o:redhat:rhel_eus:7.6",
    "package" : "systemd-0:219-62.el7_6.11"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "systemd",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Virtualization 4",
    "fix_state" : "Will not fix",
    "package_name" : "redhat-virtualization-host",
    "cpe" : "cpe:/o:redhat:rhev_hypervisor:4",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Virtualization 4",
    "fix_state" : "Will not fix",
    "package_name" : "rhvm-appliance",
    "cpe" : "cpe:/o:redhat:rhev_hypervisor:4",
    "impact" : "low"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2018-16866\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-16866\nhttps://www.qualys.com/2019/01/09/system-down/system-down.txt" ],
  "name" : "CVE-2018-16866",
  "csaw" : false
}