==========================================================================
Ubuntu Security Notice USN-3995-1
May 28, 2019

keepalived vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Keepalived could be made to crash or run programs if it received
specially crafted network traffic.

Software Description:
– keepalived: Failover and monitoring daemon for LVS clusters

Details:

It was discovered that Keepalived incorrectly handled certain HTTP status
response codes. A remote attacker could use this issue to cause Keepalived
to crash, resulting in a denial of service, or possibly execute arbitrary
code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
keepalived 1:1.3.9-1ubuntu1.1

Ubuntu 18.04 LTS:
keepalived 1:1.3.9-1ubuntu0.18.04.2

Ubuntu 16.04 LTS:
keepalived 1:1.2.24-1ubuntu0.16.04.2

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3995-1
CVE-2018-19115

Package Information:
https://launchpad.net/ubuntu/+source/keepalived/1:1.3.9-1ubuntu1.1
https://launchpad.net/ubuntu/+source/keepalived/1:1.3.9-1ubuntu0.18.04.2
https://launchpad.net/ubuntu/+source/keepalived/1:1.2.24-1ubuntu0.16.04.2

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlztPQoACgkQZWnYVadE
vpOskRAAswMwL0sl8zNIB03Q5TfGOYNaMzIaOzvW+m2QSAYhKuF4ZlXQI6LBUCaw
1hANyQdXbDzTEL8cRHJfBN7fK47k85ygf/yYUTmC1KOY+lur4si2l6w/TjbOJ9rO
gfA11zr4KM5JQUhX6PFM7hKrrCMOnf2y0w0gbe0Jcz661urx2SG8GpPcm83kYBfi
ZrfgEIvcgHTTiy9x0KZ06E8YSWS8oI/h7FV7rquneflyLqoiMid8jR3GXuIHneAW
6vR6iRtyiN54+U//3IJJpUX9be0pGGsLJ9tLl3pc142aNy3g0alsQ/MvIgjYMrVG
7o963OztlrOvQDwIaH3u5LuaOrUKy/7kYFQO10D8CBovyaFPMeNgmNSXgou4iWBt
PmKnJBcIj1HoMxxc9yArZDEvvGD11kdZb1dZ0qBd6gPcjKqWaAity4VwwvhUhlCW
/bjVXYCmQRuO8x0sWV6yYS1xm4uey+nbh/8WpbanZKK9vFUYTIUZH3bvAH6ahTgC
XOSe+mdMQrPiC9aH3jlblzxVcTzbiC2wLr3lV8N4qi3YBcqxCtXmEvIUQG3LivoJ
6X5CVgYae8IN5G7KonRlxnbM7PhVEBnaNutuKrfSY+Dte8zZ52O8zYhF+yw4B7fG
bzO1Rq1996wVi6laxpiDCW/gdgeTQ+fTp6UPHkPw7uIMGVjvMdE=
=4QoV
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-3995-2
May 28, 2019

keepalived vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 ESM
– Ubuntu 12.04 ESM

Summary:

Keepalived could be made to crash or run programs if it received
specially crafted network traffic.

Software Description:
– keepalived: Failover and monitoring daemon for LVS clusters

Details:

USN-3995-1 fixed a vulnerability in keepalived. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

 It was discovered that Keepalived incorrectly handled certain HTTP
 status response codes. A remote attacker could use this issue to cause
 Keepalived to crash, resulting in a denial of service, or possibly
 execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 ESM:
  keepalived                      1:1.2.7-1ubuntu1+esm1

Ubuntu 12.04 ESM:
  keepalived                      1:1.2.2-3ubuntu1.2

In general, a standard system update will make all the necessary
changes.

References:
  https://usn.ubuntu.com/usn/usn-3995-2
  https://usn.ubuntu.com/usn/usn-3995-1
  CVE-2018-19115—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAABCAAGBQJc7XHYAAoJEEW851uECx9piKgP/RQAOM+75/rjkAdEx5QI8r+U
eyh2/mbaUSLzK65pNbayT51d/F5poQsaPs5ixPSgNIoYbgTb3Q5VYslXoi7MpLKg
Gg8sRO0VuVN4YwaK/BSNSDpGWwz5HMWTA44RTUu3lV9GdKtRc4akL0vwSW2fujOw
xIJiGVVWfLgVOYN93yq7f8pjmRxxQXiiN5foxKYHa6viwlK3eSzPWK+gn7U+L64f
gnnutk9rFs+fkEA61rZmHukQVO8bzMW1XBoTImCIKkkKADkiSB/IahUwUGC9XKp3
00C+BA7yiMalErNRhhX7kVeLt/LfzPnuqZqmMZJQUM5rBPp4yDRpPrRHRKSHXKfM
UakhNKNVOGK0iXeKTghu+3CsKTV44zH9yeUk1gXbVM7ns+Iw4J2cadvBNEov9IwG
0XeAdRZA1qL8nTXwYiA4QUQJaps1rCJJc6PHvIlSHTx0lORFneUGjEeDmV5Z/Egm
EG1UoBg6aAmpsegFZT/f/Hz10LT9g5xpv9H7LIRKwEgNy5jNdbCPHnlv8D2nQ8lz
A1TzLk2O1bJ6Rcr7FfkMHMDgYAH3wf8O7RKXlwkxPQHBY0SVOu8rRQnFcJ67OzjE
a8xTlVON3Lo2xe6r9Ejnnw42ngLmyZXBaw1BdSMoy3r99B3aTPfzvQ2k+qb2niWW
pL1krOO57IUUpdt310I+
=dR1g
—–END PGP SIGNATURE—–
—