PT-2019-13171 · Calamares · Calamares

Tsimonq2 · Publicado 2019-07-02 · Atualizado 2020-08-24 · CVE-2019-13179

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Calamares versions 3.1 through 3.2.10

Description The issue concerns the copying of a LUKS encryption keyfile from /crypto keyfile.bin to /boot within a globally readable initramfs image. This results in the originally protected file being readable by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.

Recommendations For Calamares versions 3.1 through 3.2.10, consider updating to a version where this issue is resolved, as the current version insecurely exposes the LUKS encryption keyfile. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2019-13179

Produtos afetados

Calamares

Referências · 15

• 🔥 https://github.com/calamares/calamares/issues/1191 · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13179 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-13179 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-13179 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-13179 · Nota de Segurança
• https://calamares.io/calamares-cve-2019 · Aviso do Fabricante
• https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096 · Nota
• https://calamares.io/calamares-3.2.11-is-out · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-13179 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1726542 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13179 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13179 · Nota de Segurança