ALSA-2022:1930 - Moderate: keepalived security and bug fix update
Summary
ALSA-2022:1930: Moderate: keepalived security and bug fix update. Affects keepalived versions < 2.1.5-8.el8. Fixed in 2.1.5-8.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
keepalived is a utility that provides load balancing and high availability facilities. It relies on the IP Virtual Server (IPVS) kernel module for layer-4 load balancing and implements checkers to manage a load balanced server pool based on server health. It also supports the Virtual Router Redundancy Protocol (VRRPv2) for high availability with director failover.
Vulnerability Detail
The vulnerability in keepalived allows for dbus access control bypass (CVE-2021-44225). This can potentially lead to unauthorized access and privilege escalation. The impact of this vulnerability can vary depending on the specific configuration and usage of keepalived.
How To Fix
Minimum fixed version
2.1.5-8.el8
This is the first release that contains the fix.
sudo dnf update keepalivedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, keepalived has a vulnerability that allows for dbus access control bypass. It is recommended to update keepalived to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for keepalived →
FAQ
keepalived is a utility that provides load balancing and high availability facilities.
The vulnerability allows for dbus access control bypass, which can potentially lead to unauthorized access and privilege escalation.
To fix the vulnerability, update keepalived to version 2.1.5-8.el8 or later.
No specific workaround has been provided for this vulnerability.
You can find more information about the vulnerability in the CVE page(s) listed in the References section of the advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for keepalived.
