CVE-2018-19115: Buffer Overflow
keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extractstatuscode in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
Other sources
keepalived before version 2.0.9 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extractstatuscode in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
Upstream Patch:
https://github.com/acassen/keepalived/pull/961/commits/f28015671a4b04785859d1b4b1327b367b6a10e9
Reference:
https://bugzilla.suse.com/showbug.cgi?id=1015141
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-19115?
CVE-2018-19115 is a vulnerability in keepalived before version 2.0.7 that allows a heap-based buffer overflow when parsing HTTP status codes, leading to denial of service (DoS) or other unspecified impact.
How severe is CVE-2018-19115?
CVE-2018-19115 has a severity score of 9.8, which is considered critical.
How does CVE-2018-19115 affect keepalived?
CVE-2018-19115 affects keepalived versions before 2.0.7.
Is there a fix for CVE-2018-19115?
Yes, the fix for CVE-2018-19115 is to update keepalived to version 2.0.7 or later.
Where can I find more information about CVE-2018-19115?
You can find more information about CVE-2018-19115 at the following references: [CVE-2018-19115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19115), [GitHub Pull Request](https://github.com/acassen/keepalived/pull/961), [Ubuntu Security Notice](https://ubuntu.com/security/notices/USN-3995-1).