Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2018-19044 →
DEBIAN-CVE-2018-19044
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed l...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
keepalived
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.10-1"}]}]
Debian:13
keepalived
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.10-1"}]}]
Debian:14
keepalived
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.10-1"}]}]
Références
- advisory security-tracker.debian.org