Skip to content
OpenAdvisories
Medium WID-SEC-2025-1351 3 CVEs

Red Hat Enterprise Linux (kea): Mehrere Schwachstellen

Published Jun 17, 2025 · Updated Mar 26, 2026 · Revision 4 · de-DE

Vendor: Oracle Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux Platform: Linux

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im "kea" Paket von Red Hat Enterprise Linux ausnutzen, um seine Privilegien zu eskalieren, um Informationen offenzulegen und um einen Denial of Service Zustand herbeizuführen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 3

  • High 7.8
    CVE-2025-32801

    Loading a malicious hook library can lead to local privilege escalation

    Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions…

    ISC Kea isc-kea kea Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2025-32802

    Insecure handling of file paths allows multiple local attacks

    Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure pat…

    ISC Kea isc-kea kea Debian Ubuntu Alpine
  • Medium 4.0
    CVE-2025-32803

    Insecure file permissions can result in confidential information leakage

    In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

    ISC Kea kea isc-kea Debian Ubuntu Alpine

Revision history

  1. #4

    Neue Updates von SUSE aufgenommen

  2. #3

    Neue Updates von SUSE aufgenommen

  3. #2

    Neue Updates von Oracle Linux aufgenommen

  4. #1

    Initiale Fassung

References