CVE-2018-19046
Fixed in a distro release EPSS <1%
keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information.
Products: keepalived
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | keepalived | 1:2.0.10-1 |
| Debian 13 | keepalived | 1:2.0.10-1 |
| Debian 14 | keepalived | 1:2.0.10-1 |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | keepalived | 2.0.19-3.3.1 |
| Ubuntu 18.04 LTS | keepalived | no fix |
| openSUSE Tumbleweed | keepalived | 2.2.2-4.2 |