CVE-2018-19115
Critical
Description
keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Keepalived
PublishedNov 8, 2018
First seenNov 8, 2018
How to fix
Update
- keepalived keepalived2.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| keepalived keepalived | v < 2.0.7 | 2.0.7 |
| debian debian_linux | 8.0 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_server_aus | 7.6 | — |
| redhat enterprise_linux_server_eus | 7.6 | — |
| redhat enterprise_linux_server_tus | 7.6 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.