REDHAT-BUG-2367495: Medium severity Internet Systems Consortium Kea vulnerability

Published May 20, 2025

Updated

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.

Affected Software

1 affected component

Internet Systems Consortium Kea

Event History

May 20, 2025

Data Sourced

via Red Hat·03:08 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are most exposed?

Deployments that run Kea as root, leave its API entry points unsecured, or place control sockets in insecure paths are most exposed. The impact is limited by the permissions granted to the Kea process.

What access would an attacker need?

An attacker would need access to Kea configuration directives or API directives that can be used to write files. Unsecured API entry points or insecurely located control sockets can provide a path to that access.

How can I assess whether my deployment has the risky conditions?

Check which account runs Kea and determine the file permissions available to that account. Also review whether API entry points are unsecured and whether control sockets are located in paths accessible to untrusted users.

What can be done if an update cannot be applied immediately?

Reduce the permissions granted to Kea where possible, secure API entry points, and ensure control sockets are not placed in insecure paths. Avoid running Kea as root when the deployment does not require it.

REDHAT-BUG-2367495: Medium severity Internet Systems Consortium Kea vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are most exposed?

What access would an attacker need?

How can I assess whether my deployment has the risky conditions?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed?

What access would an attacker need?

How can I assess whether my deployment has the risky conditions?

What can be done if an update cannot be applied immediately?