USN-7478-1: Corosync vulnerability
It was discovered that Corosync incorrectly handled certain large UDP packets. If encryption is disabled, or an attacker knows the encryption key, this issue could be used to cause Corosync to crash, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7478-1?
The severity of USN-7478-1 is high due to the potential for denial of service caused by large UDP packets.
How do I fix USN-7478-1?
To fix USN-7478-1, upgrade Corosync to version 3.1.8-2ubuntu1.1 or later for Ubuntu 24.10.
What versions of Corosync are affected by USN-7478-1?
USN-7478-1 affects versions of Corosync prior to 3.1.8-2ubuntu1.1, 3.1.7-1ubuntu3.1, 3.1.6-1ubuntu1.1, and 3.0.3-2ubuntu2.2.
What is the impact of the vulnerability in USN-7478-1?
The impact of the vulnerability in USN-7478-1 can lead to a crash of the Corosync service, resulting in a denial of service.
Is encryption required to exploit USN-7478-1?
Encryption is not required to exploit USN-7478-1, as an attacker can trigger the vulnerability if they know the encryption key.