CVE-2018-19046 — Sensitive Information Exposure in Keepalived
Severity
4.7MEDIUMNVD
EPSS
0.1%
top 65.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 8
Latest updateMay 14
Description
keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.0 | Impact: 3.6
Affected Packages3 packages
Patches
🔴Vulnerability Details
2📋Vendor Advisories
2💬Community
2Bugzilla▶
CVE-2018-19046 keepalived: Insecure use of temporary files allows attackers read sensitive information from pre-existing files↗2018-11-21
Bugzilla▶
CVE-2018-19046 keepalived: Insecure use of temporary files allows attackers read sensitive information from pre-existing files [fedora-all]↗2018-11-21