PT-2018-3574 · Unknown+2 · Keepalived+2
Jsegitz
·
Published
2018-10-25
·
Updated
2024-06-15
·
CVE-2018-19046
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
keepalived version 2.0.8
Description
The issue is related to the handling of temporary files when the
PrintData or PrintStats functions are called. A local attacker could potentially exploit this by creating a file with a specific name, such as /tmp/keepalived.data or /tmp/keepalived.stats, with read access for the attacker and write access for the keepalived process. This could lead to the leakage of sensitive information.Recommendations
For keepalived version 2.0.8, consider restricting access to the temporary files used by the
PrintData and PrintStats functions to prevent potential information leakage. As a temporary workaround, avoid using the PrintData and PrintStats functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Suse
Keepalived