CVE-2018-19115 - CVE House
Back to Database
Status published Critical CVE-2018-19115

keepalived before 2.0.7 has a heap-based buffer overflow when parsing...

Vulnerability Description

keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19115

Credits & Attribution

No credits recorded in the NVD database.

References

More from keepalived

View All →
CVE-2021-44225
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently...
Medium 5.4
CVE-2018-19046
keepalived 2.0.8 didn't check for existing plain files when writing...
Medium 4.7
CVE-2018-19045
keepalived 2.0.8 used mode 0666 when creating new temporary files...
High 7.5
CVE-2018-19044
keepalived 2.0.8 didn't check for pathnames with symlinks when writing...
Medium 4.7
CVE-2011-1784
The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier...
Low 3.6

Affected Vendor

Affected Software

keepalived, debian linux, enterprise linux server, enterprise linux server aus, enterprise linux server eus, enterprise linux server tus, enterprise linux workstation
Vulnerable Versions:
0, 8.0, 7.0, 7.6

Timeline

Official Publish: November 8th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.