Summary
It was discovered that Keepalived incorrectly handled certain HTTP status
response codes. A remote attacker could use this issue to cause Keepalived
to crash, resulting in a denial of service, or possibly execute arbitrary
code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | keepalived | 1:1.2.24-1ubuntu0.16.04.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | keepalived | 1:1.3.9-1ubuntu0.18.04.2 |
Vulnerabilities 1
-
Unscored —
keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly un…
References
-
report
https://ubuntu.com/security/CVE-2018-19115