PT-2019-13171 · Calamares · Calamares

Tsimonq2 · Published 2019-07-02 · Updated 2020-08-24 · CVE-2019-13179

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Calamares versions 3.1 through 3.2.10

Description The issue concerns the copying of a LUKS encryption keyfile from /crypto keyfile.bin to /boot within a globally readable initramfs image. This results in the originally protected file being readable by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.

Recommendations For Calamares versions 3.1 through 3.2.10, consider updating to a version where this issue is resolved, as the current version insecurely exposes the LUKS encryption keyfile. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-13179

Affected Products

Calamares

References · 15

• 🔥 https://github.com/calamares/calamares/issues/1191 · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13179 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13179 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-13179 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13179 · Security Note
• https://calamares.io/calamares-cve-2019 · Vendor Advisory
• https://calamares.io/calamares-3.2.11-is-out · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13179 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13179 · Security Note
• https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1726542 · Note