CVEvulnerability
CVE-2019-13179
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-07-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-522
Description
Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.
Affected configurations
• calamares calamares (<= 3.2.10)
Related
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095 Exploit, Issue Tracking, Third Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1726542 Issue Tracking, Third Party Advisory
- https://calamares.io/calamares-3.2.11-is-out/ Vendor Advisory
- https://calamares.io/calamares-cve-2019/ Vendor Advisory
- https://github.com/calamares/calamares/issues/1191 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC/ lists.fedoraproject.org
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095 Exploit, Issue Tracking, Third Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1726542 Issue Tracking, Third Party Advisory
- https://calamares.io/calamares-3.2.11-is-out/ Vendor Advisory
- https://calamares.io/calamares-cve-2019/ Vendor Advisory
- https://github.com/calamares/calamares/issues/1191 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC/ lists.fedoraproject.org