keepalived-1.3.5-8.el7
エラータID: AXSA:2019-3747:01
Release date:
Wednesday, April 3, 2019 - 10:16
Subject:
keepalived-1.3.5-8.el7
Affected Channels:
Asianux Server 7 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- keepalivedには、ステータスコードのバリデーションにヒープオーバーフローが存在し、
DoS攻撃や他の不明な攻撃につながる脆弱性があります。(CVE-2018-19115)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
Solution:
パッケージをアップデートしてください。
CVEs:
CVE-2018-19115
keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
Additional Info:
N/A
Download:
SRPMS
- keepalived-1.3.5-8.el7.src.rpm
MD5: 54d7757417f21e3226d9dfc2a5b6960c
SHA-256: 21fdffcdad0903996506fdfe88099b9384a4285962bfbf4b750f030696c99c82
Size: 703.33 kB
Asianux Server 7 for x86_64
- keepalived-1.3.5-8.el7.x86_64.rpm
MD5: 7972871113d820d708cf39d109d19104
SHA-256: 6b0f8591c38e469a6e42cc169f3e28cb1c1578eb065e10ba7f193c934be5354a
Size: 328.16 kB