CVE-2021-44225
Fixed in a distro release EPSS 1%
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property
Products: keepalived, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | keepalived | 2.1.5-8.el8 |
| Amazon Linux 2 | keepalived | 1.3.5-16.amzn2.0.4 |
| Arch Linux | keepalived | 2.2.5-1 |
| Debian 10 | keepalived | 1:2.0.10-1+deb10u1 |
| Debian 12 | keepalived | 1:2.2.4-0.2 |
| Debian 13 | keepalived | 1:2.2.4-0.2 |
| Debian 14 | keepalived | 1:2.2.4-0.2 |
| Red Hat Enterprise Linux 8 | keepalived | 0:2.1.5-8.el8 |
| Red Hat Enterprise Linux 8 | keepalived-debuginfo | 0:2.1.5-8.el8 |
| Red Hat Enterprise Linux 8 | keepalived-debugsource | 0:2.1.5-8.el8 |
| Rocky Linux 8 | keepalived | 0:2.1.5-8.el8 |
| SUSE HPE Helion OpenStack 8 | keepalived | 2.0.19-3.9.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | keepalived | 2.0.19-150100.3.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | keepalived | 2.0.19-150100.3.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP3 | keepalived | 2.0.19-150100.3.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | keepalived | 2.2.2-150400.3.5.1 |
| SUSE OpenStack Cloud 8 | keepalived | 2.0.19-3.9.1 |
| SUSE OpenStack Cloud 9 | keepalived | 2.0.19-3.6.1 |
| SUSE OpenStack Cloud Crowbar 8 | keepalived | 2.0.19-3.9.1 |
| SUSE OpenStack Cloud Crowbar 9 | keepalived | 2.0.19-3.6.1 |
| Ubuntu 18.04 LTS | keepalived | 1:1.3.9-1ubuntu0.18.04.3 |
| Ubuntu 20.04 LTS | keepalived | 1:2.0.19-2ubuntu0.1 |
| Ubuntu 22.04 LTS | keepalived | 1:2.2.4-0.2 |
| openSUSE Leap 15.3 | keepalived | 2.0.19-150100.3.6.1 |
| openSUSE Leap 15.4 | keepalived | 2.2.2-150400.3.5.1 |
| openSUSE Tumbleweed | keepalived | 2.2.7-1.1 |