Bugzilla – Bug 1140256
VUL-0: CVE-2019-13178: calamares: race condition in modules/luksbootkeyfile/main.py
Last modified: 2019-12-09 17:16:14 UTC
CVE-2019-13178 modules/luksbootkeyfile/main.py in Calamares through 3.2.4 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set. Reference: https://github.com/calamares/calamares/issues/1190 https://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/ https://www.pavelkogan.com/2015/01/25/linux-mint-encryption/ References: https://bugzilla.redhat.com/show_bug.cgi?id=1726565 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13178 http://www.cvedetails.com/cve/CVE-2019-13178/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13178 https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096 https://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/ https://www.pavelkogan.com/2015/01/25/linux-mint-encryption/ https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095 https://github.com/calamares/calamares/issues/1190
I am testing Calamares 3.2.14. However seems that Calamares 3.2.2 introduced new bug that prevents us to update Calamares: https://github.com/calamares/calamares/issues/1253
Should be fixed now in openSUSE Factory with Calamares 3.2.15. I will submit maintenance request to Leap
This is an autogenerated message for OBS integration: This bug (1140256) was mentioned in https://build.opensuse.org/request/show/749018 15.0 / calamares
More complete submission... please accept review https://build.opensuse.org/request/show/749077
Back to security team for processing
openSUSE-SU-2019:2628-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1140256,1152377 CVE References: CVE-2019-13178 Sources used: openSUSE Leap 15.1 (src): calamares-3.2.15-lp151.4.3.3 openSUSE Leap 15.0 (src): calamares-3.2.15-lp150.7.2
After this update, should be fixed. Closing
openSUSE-SU-2019:2655-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1140256,1152377 CVE References: CVE-2019-13178 Sources used: openSUSE Backports SLE-15-SP1 (src): calamares-3.2.15-bp151.4.3.1
openSUSE-SU-2019:2654-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1140256,1152377 CVE References: CVE-2019-13178 Sources used: openSUSE Backports SLE-15 (src): calamares-3.2.15-bp150.2.6.1