CVE-2018-19044

low-risk

Published 2018-11-08

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.

Do I need to act?

0.12% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.7/10 Medium

LOCAL / HIGH complexity

Affected Products (1)

Keepalived

Affected Vendors

Keepalived

References (10)

https://access.redhat.com/errata/RHSA-2019:2285

Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1015141

Patch https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe27...

Exploit https://github.com/acassen/keepalived/issues/1048

Third Party Advisory https://security.gentoo.org/glsa/201903-01

https://access.redhat.com/errata/RHSA-2019:2285

Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1015141

Patch https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe27...

Exploit https://github.com/acassen/keepalived/issues/1048

Third Party Advisory https://security.gentoo.org/glsa/201903-01

/ 100

low-risk

Severity 12/34 · Low

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal