CVE-2018-19044

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.

Metrics

CVSS 3.0 4.7/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://access.redhat.com/errata/RHSA-2019:2285
https://bugzilla.suse.com/show_bug.cgi?id=1015141Issue Tracking, Third Party Advisory
https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306Patch, Third Party Advisory
https://github.com/acassen/keepalived/issues/1048Exploit, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201903-01Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2285
https://bugzilla.suse.com/show_bug.cgi?id=1015141Issue Tracking, Third Party Advisory
https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306Patch, Third Party Advisory
https://github.com/acassen/keepalived/issues/1048Exploit, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201903-01Third Party Advisory

Timeline

Published: Nov 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-190457.5keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive info CVE-2018-190464.7keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a lo CVE-2018-1904710.0mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.16 CVE-2018-190486.1Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.CVE-2018-19057.1IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML d CVE-2018-190506.1MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.CVE-2018-190516.1MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.CVE-2018-190527.5An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a s CVE-2018-190537.2PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statem CVE-2018-190566.1pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.CVE-2018-190576.1SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandle CVE-2018-190586.5An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in