In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile because an empty ipset name must be configured by the user.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:3658-1 advisory.

    - CVE-2024-41184: fixed integer overflow in vrrp_ipsets_handler (bsc#1228123)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:3634-1 advisory.

    - CVE-2024-41184: Fixed integer overflow in vrrp_ipsets_handler (bsc#1228123)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:3633-1 advisory.

    -  CVE-2024-41184: Fixed integer overflow in vrrp_ipsets_handler (bsc#1228123)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of keepalived installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-41184 advisory.

  - In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can     occur. NOTE: this CVE Record might not be worthwhile because an empty ipset name must be configured by the     user. (CVE-2024-41184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:3031-1 advisory.

    - CVE-2024-41184: Fixed integer overflow in vrrp_ipsets_handler (bsc#1228123)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the keepalived package has been released.

ID	Name	Product	Family	Severity
209220	SUSE SLES15 Security Update : keepalived (SUSE-SU-2024:3658-1)	Nessus	SuSE Local Security Checks	critical
209079	SUSE SLES15 / openSUSE 15 Security Update : keepalived (SUSE-SU-2024:3634-1)	Nessus	SuSE Local Security Checks	critical
209073	SUSE SLES15 / openSUSE 15 Security Update : keepalived (SUSE-SU-2024:3633-1)	Nessus	SuSE Local Security Checks	critical
207522	CBL Mariner 2.0 Security Update: keepalived (CVE-2024-41184)	Nessus	MarinerOS Local Security Checks	critical
206265	SUSE SLES15 Security Update : keepalived (SUSE-SU-2024:3031-1)	Nessus	SuSE Local Security Checks	critical
205577	Photon OS 5.0: Keepalived PHSA-2024-5.0-0347	Nessus	PhotonOS Local Security Checks	critical
205576	Photon OS 4.0: Keepalived PHSA-2024-4.0-0667	Nessus	PhotonOS Local Security Checks	critical
205573	Photon OS 3.0: Keepalived PHSA-2024-3.0-0781	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2024-41184

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical