Unrated
Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally r...
CVE-2019-13179
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2019-13179 calamares Fixed in: 3.2.11-1
Original description The description as published by the source.
Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.
References
- advisory bugs.launchpad.net
- advisory calamares.io
- advisory calamares.io
- report bugs.launchpad.net
- report bugzilla.redhat.com
- report github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org