Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2021-44225 →

DEBIAN-CVE-2021-44225

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 keepalived

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.4-0.2"}]}]

Debian:13 keepalived

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.4-0.2"}]}]

Debian:14 keepalived

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.4-0.2"}]}]

Références

advisory security-tracker.debian.org