CVE-2021-44225 — Improper Authentication in Keepalived

CWE-287 — Improper AuthenticationCWE-668 — Resource Exposure7 documents7 sources
Severity
5.4MEDIUMNVD
EPSS
0.1%
top 83.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
KeepalivedDebian KeepalivedFedoraproject Fedora+6 more
Timeline
PublishedNov 26
Latest updateDec 13

Description

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages9 packages

▶debiandebian/keepalived< keepalived 1:2.2.4-0.2 (bookworm)
▶Debiankeepalived/keepalived< 1:2.1.5-0.2+deb11u1+3

Also affects: Fedora 34, 35

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-jpw2-cwxg-4qv8: In Keepalived through 2↗2021-11-27
▶
OSV
CVE-2021-44225: In Keepalived through 2↗2021-11-26
▶

📋Vendor Advisories

4
Ubuntu
Keepalived vulnerability↗2021-12-13
▶
Red Hat
keepalived: dbus access control bypass↗2021-11-26
▶
Microsoft
In Keepalived through 2.2.4 the D-Bus policy does not sufficiently restrict the message destination allowing any user to inspect and manipulate any property. This leads to access-control bypass in som↗2021-11-09
▶
Debian
CVE-2021-44225: keepalived - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the...↗2021
▶
CVE-2021-44225 — Improper Authentication in Keepalived | cvebase