CVE-2018-19046 - CVE House
Back to Database
Status published Medium CVE-2018-19046

keepalived 2.0.8 didn't check for existing plain files when writing...

Vulnerability Description

keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19046

Credits & Attribution

No credits recorded in the NVD database.

References

More from keepalived

View All →
CVE-2021-44225
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently...
Medium 5.4
CVE-2018-19115
keepalived before 2.0.7 has a heap-based buffer overflow when parsing...
Critical 9.8
CVE-2018-19045
keepalived 2.0.8 used mode 0666 when creating new temporary files...
High 7.5
CVE-2018-19044
keepalived 2.0.8 didn't check for pathnames with symlinks when writing...
Medium 4.7
CVE-2011-1784
The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier...
Low 3.6

Affected Vendor

Affected Software

keepalived
Vulnerable Versions:
2.0.8

Timeline

Official Publish: November 8th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.