AIDE improper output neutralization vulnerability
Priority MEDIUM 61CWE-117Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 16 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial aide (aide): 0.19.2Red Hat: 12 advisoriesRed Hat: 16 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aide | aide | before 0.19.2 | 0.19.2 | Patch available | CNA |
- aide Vendoraide Affected before 0.19.2 Fixed in 0.19.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:* | before 0.19.2 | Vulnerable | Advanced Intrusion Detection Environment Project |
- cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:* Versions before 0.19.2 Vulnerable ·Advanced Intrusion Detection Environment Project
Remediation
- Fix · CNA aide (aide) Fixed in 0.19.2
Red Hat 12 advisories
- RHSA-2025:21913 Released 2025-11-21 · Red Hat rating ImportantOpenShift File Integrity Operator bug fix and enhancement update
- OpenShift File Integrity Operator - FIO 1 registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator
- RHSA-2025:15728 Released 2025-09-15 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux Server (v. 7 ELS) aide-0.15.1-13.el7_9.5
- RHSA-2025:15409 Released 2025-09-08 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) aide-0.16-100.el9_0.1
Show 9 more Red Hat advisories
- RHSA-2025:15058 Released 2025-09-02 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) aide-0.16-15.el8_6.1
- Red Hat Enterprise Linux AppStream E4S (v.8.6) aide-0.16-15.el8_6.1
- Red Hat Enterprise Linux AppStream TUS (v.8.6) aide-0.16-15.el8_6.1
- RHSA-2025:15039 Released 2025-09-02 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) aide-0.16-100.el9_4.1
- RHSA-2025:15038 Released 2025-09-02 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) aide-0.16-100.el9_2.1
- RHSA-2025:14982 Released 2025-09-02 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) aide-0.16-15.el8_8.1
- Red Hat Enterprise Linux AppStream TUS (v.8.8) aide-0.16-15.el8_8.1
- RHSA-2025:14981 Released 2025-09-02 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) aide-0.16-14.el8_4.2
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) aide-0.16-14.el8_4.2
- RHSA-2025:14980 Released 2025-09-02 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) aide-0.16-11.el8_2.2
- RHSA-2025:14592 Released 2025-08-26 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream (v. 10) aide-0.18.6-8.el10_0.2
- RHSA-2025:14573 Released 2025-08-26 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream (v. 8) aide-0.16-15.el8_10.2
- RHSA-2025:14493 Released 2025-08-25 · Red Hat rating Importantaide security update
- Red Hat Enterprise Linux AppStream (v. 9) aide-0.16-103.el9_6.2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| OpenShift File Integrity Operator - FIO 1 | Fixed | RHSA-2025:21913 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:14592 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:14573 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:14493 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2025:14980 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2025:14981 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:15058 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:15058 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2025:14982 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:15409 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:15038 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:15039 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2025:14981 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:15058 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2025:14982 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:15728 |
Not affected: 1 product
- OpenShift File Integrity Operator - FIO 1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54389
References
More Advanced Intrusion Detection Environment Project Advanced Intrusion Detection Environment vulnerabilities
- TI-2025-34215 AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS) CVSS 3.1MEDIUM 6.2
- TI-2021-20518 AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata… CVSS 3.1HIGH 7.8
Sources
- CVE-2025-54389 · CVE Program
- CVE-2025-54389 · NVD
- FIRST EPSS
- CVE-2025-54389 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences