A content injection flaw was found in the ABRT post-create event handler scripts in libreport. The event script reads systemd journal entries that match a crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. It corresponds to CWE-74 and allows a local user, by embedding newline characters in syslog messages, to inject arbitrary content into the journal output. This gives the attacker control over the data root writes to dump directory files, potentially enabling the insertion of malicious payloads or code that may later be processed when the dump files are accessed.

Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8 are impacted. The vulnerability exists in the ABRT component of these distributions; no more granular version details are provided, so any RHEL 6, 7, or 8 system with ABRT installed is at risk.

The CVSS base score is 5.5, indicating moderate severity, and the EPSS score is not available while the vulnerability is not listed in the CISA KEV catalog. The attack vector is local only, requiring a user to write to the systemd journal and embed newline characters. Given the moderate score and local nature, the overall risk is moderate, but the ability to inject arbitrary content into root-owned dump files could assist a local attacker in further compromising the system.