keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade keepalivedUpgrade keepalived-debuginfo | Apr 27, 2020 | Nov 8, 2018 |
| Centos_linux | — | Upgrade keepalivedUpgrade keepalived-debuginfo | Jan 8, 2019 | Nov 8, 2018 |
| Debian | — | Upgrade keepalived | Feb 19, 2019 | Nov 8, 2018 |
| Gentoo Linux | — | Upgrade sys-cluster/keepalived. | Mar 11, 2019 | Nov 8, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade keepalived | Jul 23, 2019 | Nov 8, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade keepalived | Sep 25, 2019 | Nov 8, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade keepalived | Jul 2, 2019 | Nov 8, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade keepalived | Jul 26, 2019 | Nov 8, 2018 |
| Oracle_linux | — | Upgrade keepalived | Jul 21, 2020 | Nov 8, 2018 |
| Redhat_linux | — | Upgrade keepalived-debuginfoNo solution existsUpgrade keepalived | Jan 4, 2019 | Nov 8, 2018 |
| Ubuntu | — | Upgrade keepalivedUpgrade keepalived (Ubuntu Pro) | May 29, 2019 | Nov 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub