CVE-2021-44225

En Keepalived versiones hasta 2.2.4, la política D-Bus no restringe suficientemente el destino de los mensajes, permitiendo a cualquier usuario inspeccionar y manipular cualquier propiedad. Esto conlleva a una omisión del control de acceso en algunas situaciones en las que un servicio del sistema D-Bus no relacionado presenta una propiedad configurable (escribible)

A flaw was found in keepalived, where an improper authentication vulnerability allows an unprivileged user to change properties that could lead to an access-control bypass.

The keepalived utility provides simple and robust facilities for load balancing and high availability. The load balancing framework relies on the well-known and widely used IP Virtual Server kernel module providing layer-4 load balancing. Keepalived implements a set of checkers to dynamically and adaptively maintain and manage a load balanced server pool according to the health of the servers. Keepalived also implements the Virtual Router Redundancy Protocol to achieve high availability with director failover. Issues addressed include a bypass vulnerability.