CVE-2018-19044
Fixed in a distro release EPSS <1%
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.
Products: keepalived
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | keepalived | 1.3.5-16.amzn2 |
| Debian 12 | keepalived | 1:2.0.10-1 |
| Debian 13 | keepalived | 1:2.0.10-1 |
| Debian 14 | keepalived | 1:2.0.10-1 |
| Red Hat Enterprise Linux 7 | keepalived | 0:1.3.5-16.el7 |
| Red Hat Enterprise Linux 7 | keepalived-debuginfo | 0:1.3.5-16.el7 |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | keepalived | 2.0.19-3.3.1 |
| Ubuntu 18.04 LTS | keepalived | no fix |
| openSUSE Tumbleweed | keepalived | 2.2.2-4.2 |