CVE-2018-1084
corosync: corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.
CVE-2018-1084 is fixed in 12 products on 1 platform, first by corosync 2.4.3-0ubuntu1.1, released April 11, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0311
87th percentile
corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| corosync · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | corosync 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| corosync-notifyd · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | corosync-notifyd 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| corosync-qdevice · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | corosync-qdevice 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| corosync-qnetd · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | corosync-qnetd 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| libcfg6 · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | libcfg6 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| libcmap4 · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | libcmap4 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| libcorosync-common4 · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | libcorosync-common4 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| libcpg4 · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | libcpg4 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| libquorum5 · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | libquorum5 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| libsam4 · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | libsam4 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| libtotem-pg5 · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | libtotem-pg5 2.4.3-0ubuntu1.1 | Apr 11, 2018 |
| libvotequorum8 · Ubuntu 18.04.6 LTS (bionic) | 2.4.3-0ubuntu1.1 | libvotequorum8 2.4.3-0ubuntu1.1 | Apr 11, 2018 |