Improper Neutralization of Escape, Meta, or Control Sequences in tracing-subscriber - CVE-2025-58160

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU114683

Improper Neutralization of Escape, Meta, or Control Sequences in tracing-subscriber - CVE-2025-58160

Published: September 2, 2025


Vulnerability identifier: #VU114683
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-58160
CWE-ID: CWE-150
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to poison application logs.

The vulnerability exists due to improper validation of ANSI characters. A remote attacker can pass specially crafted input containing ANSI escape sequences and perform log poisoning. 


Affected software

tracing-subscriber
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Basesystem Module
Development Tools Module
openSUSE Leap
rust-matchers
rust-crypto-auditing-client
rust-crypto-auditing-agent
rust-crypto-auditing-event-broker
rust-gufo-xmp
rust-gufo-webp
rust-gufo-tiff
rust-gufo-png
rust-gufo-jpeg
rust-gufo-exif
rust-gufo
rust-busd
rust-tracing-subscriber
rust-monitord-exporter
xwayland-satellite
bpftop
himmelblau
pam-himmelblau
libnss_himmelblau2
himmelblau-debuginfo
himmelblau-sshd-config
uv
python-uv-build
tuigreet
rust-monitord
rust-ashpd0.11
ruff
rust-ashpd
bustle
rust-bindgen-debuginfo
rust-bindgen-debugsource
rust-bindgen
rust-glycin-common
rust-gufo-common
glycin
cargo-packaging
python311-maturin
ntpd-rs
maturin
rustup-debugsource
rustup
rustup-debuginfo
rust-glycin
rust-glycin-utils
niri
snapshot
loupe

How to mitigate CVE-2025-58160

Install updates from vendor's website.

tracing-subscriber - update to 0.3.20
rust-matchers - addressed in versions 0.2.0-1.el9, 0.2.0-1.el10_2, 0.2.0-1.fc41, 0.2.0-1.fc42, 0.2.0-1.fc43, 0.2.0-1.fc44
rust-crypto-auditing-client - addressed in versions 0.2.3-2.fc41, 0.2.3-4.fc42, 0.2.3-4.fc43
rust-crypto-auditing-agent - addressed in versions 0.2.3-3.fc41, 0.2.3-5.fc42, 0.2.3-5.fc43
rust-crypto-auditing-event-broker - addressed in versions 0.2.3-3.fc41, 0.2.3-5.fc42, 0.2.3-5.fc43
rust-gufo-xmp - addressed in versions 0.3.0-1.fc43, 0.3.0-1.fc44
rust-gufo-webp - addressed in versions 0.3.0-1.fc43, 0.3.0-1.fc44
rust-gufo-tiff - addressed in versions 0.3.0-1.fc43, 0.3.0-1.fc44
rust-gufo-png - addressed in versions 0.3.0-1.fc43, 0.3.0-1.fc44
rust-gufo-jpeg - addressed in versions 0.3.0-1.fc43, 0.3.0-1.fc44
rust-gufo-exif - addressed in versions 0.3.0-1.fc43, 0.3.0-1.fc44
rust-gufo - addressed in versions 0.3.0-1.fc43, 0.3.0-1.fc44
rust-busd - addressed in versions 0.3.1-4.fc41, 0.3.1-4.fc42, 0.3.1-4.fc43
rust-tracing-subscriber - addressed in versions 0.3.20-1.el9, 0.3.20-1.el10_2, 0.3.20-1.fc41, 0.3.20-1.fc42, 0.3.20-1.fc43, 0.3.20-1.fc44
rust-monitord-exporter - addressed in versions 0.4.1-2.fc41, 0.4.1-5.fc42, 0.4.1-5.fc43
xwayland-satellite - addressed in versions 0.7-1.fc41, 0.7-1.fc42
bpftop - update to 0.7.1-1.fc44
himmelblau - update to 0.7.18+git.0.8485a75-150700.3.6.1
pam-himmelblau - update to 0.7.18+git.0.8485a75-150700.3.6.1
libnss_himmelblau2 - update to 0.7.18+git.0.8485a75-150700.3.6.1
himmelblau-debuginfo - update to 0.7.18+git.0.8485a75-150700.3.6.1
himmelblau-sshd-config - update to 0.7.18+git.0.8485a75-150700.3.6.1
uv - update to 0.8.11-2.fc44
python-uv-build - update to 0.8.11-2.fc44
tuigreet - addressed in versions 0.9.1-4.fc41, 0.9.1-4.fc42, 0.9.1-4.fc43
rust-monitord - addressed in versions 0.10.1-2.fc41, 0.12.1-3.fc42, 0.12.1-3.fc43
rust-ashpd0.11 - addressed in versions 0.11.0-1.fc43, 0.11.0-1.fc44
ruff - addressed in versions 0.11.5-7.el10_2, 0.11.5-7.fc41, 0.11.5-7.fc42, 0.11.5-7.fc43
rust-ashpd - addressed in versions 0.12.0-1.fc43, 0.12.0-1.fc44
bustle - update to 0.12.0-3.fc43
rust-bindgen-debuginfo - update to 0.72.0-150600.13.3.1
rust-bindgen-debugsource - update to 0.72.0-150600.13.3.1
rust-bindgen - update to 0.72.0-150600.13.3.1
rust-glycin-common - addressed in versions 1.0.0~rc-1.fc43, 1.0.0~rc-1.fc44
rust-gufo-common - addressed in versions 1.0.1-1.fc43, 1.0.1-1.fc44
glycin - addressed in versions 1.1.6-3.fc41, 1.2.3-5.fc42, 2.0~rc-1.fc43, 2.0~rc-1.fc44
cargo-packaging - update to 1.3.0+0-150600.3.3.1
python311-maturin - update to 1.4.0-150600.3.9.1
ntpd-rs - addressed in versions 1.6.2-1.fc41, 1.6.2-1.fc42, 1.6.2-1.fc43
maturin - addressed in versions 1.8.7-2.el10_2, 1.8.7-2.fc41, 1.8.7-2.fc42, 1.8.7-2.fc43
rustup-debugsource - update to 1.28.2~0-150600.10.13.1
rustup - update to 1.28.2~0-150600.10.13.1
rustup-debuginfo - update to 1.28.2~0-150600.10.13.1
rustup - addressed in versions 1.28.2-6.fc41, 1.28.2-6.fc42, 1.28.2-6.fc43
rust-glycin - addressed in versions 3.0.0~rc-2.fc43, 3.0.0~rc-2.fc44
rust-glycin-utils - addressed in versions 4.0.0~rc-1.fc43, 4.0.0~rc-1.fc44
niri - addressed in versions 25.08-1.fc41, 25.08-1.fc42
snapshot - addressed in versions 47.1-2.fc41, 48.0.1-2.fc42, 49~rc-1.fc43
loupe - addressed in versions 47.4-2.fc41, 48.1-2.fc42, 49~rc-1.fc43

External References

Related Security Bulletins