CVE catalog

CVE-2019-13178

calamares: CVE-2019-13178

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.69% · Oct 25, 2026

modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancalamaressid3.4.3-1fixed
Debiancalamaresforky3.4.2-1.1fixed
Debiancalamarestrixie3.3.14-1fixed
Debiancalamaresbookworm3.2.61-1fixed
Susecalamarespackage hub 153.2.15-bp150.2.6.1fixed
Opensusecalamaresleap 15.03.2.15-lp151.4.3.3fixed
Opensusecalamaresleap 15.13.2.15-lp151.4.3.3fixed
Susecalamarespackage hub 15 sp13.2.15-bp151.4.3.1fixed
Ubuntucalamares18.043.1.7-1vulnerable
Ubuntucalamares18.043.1.7-2vulnerable
Ubuntucalamares18.043.1.8-0ubuntu1vulnerable
Ubuntucalamares18.043.1.8-1vulnerable
Ubuntucalamares18.043.1.9-1vulnerable
Ubuntucalamares18.043.1.10-1vulnerable
Ubuntucalamares18.043.1.12-0ubuntu1vulnerable
Ubuntucalamares18.043.1.12-1vulnerable
Ubuntucalamares20.043.2.14-0ubuntu2vulnerable
Ubuntucalamares20.043.2.14-0ubuntu3vulnerable
Ubuntucalamares20.043.2.17.1-0ubuntu1vulnerable
Ubuntucalamares20.043.2.17.1-0ubuntu2vulnerable
Ubuntucalamares20.043.2.17.1-0ubuntu4vulnerable
Ubuntucalamares20.043.2.17.1-0ubuntu5vulnerable
Ubuntucalamares20.043.2.18-0ubuntu1vulnerable
Ubuntucalamares20.043.2.19-0ubuntu1vulnerable
Ubuntucalamares20.043.2.19.1-0ubuntu1vulnerable
Ubuntucalamares20.043.2.20-0ubuntu1vulnerable
Ubuntucalamares22.043.2.41.1-0ubuntu1vulnerable
Ubuntucalamares22.043.2.41.1-0ubuntu2vulnerable
Ubuntucalamares22.043.2.41.1-0ubuntu3vulnerable
Ubuntucalamares22.043.2.41.1-0ubuntu4vulnerable
Ubuntucalamares22.043.2.60-0ubuntu0.1vulnerable
Ubuntucalamares22.043.2.61-0ubuntu0.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancalamaressourcesid3.2.11-1unimportantNot reported[931391]
Debiancalamaressourceforky3.2.11-1unimportantNot reported[931391]
Debiancalamaressourcetrixie3.2.11-1unimportantNot reported[931391]
Debiancalamaressourcebookworm3.2.11-1unimportantNot reported[931391]
Susecalamaresrpmpackage hub 153.2.15-bp150.2.6.1Not reportedOPENSUSE-SU-2019:2654-1Not reported
Opensusecalamaresrpmleap 15.03.2.15-lp151.4.3.3Not reportedOPENSUSE-SU-2019:2628-1Not reported
Opensusecalamaresrpmleap 15.13.2.15-lp151.4.3.3Not reportedOPENSUSE-SU-2019:2628-1Not reported
Susecalamaresrpmpackage hub 15 sp13.2.15-bp151.4.3.1Not reportedOPENSUSE-SU-2019:2655-1Not reported

[Debian bug #931391]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [calamares]Fixed
    Details (4)

    • 3.2.61-1+b1 · amd64 · bookworm

      Fixed · Fixed: 3.2.11-1

      dsa · calamares · debian · bookworm; dsa · calamares · debian · 12

    • 3.2.61-1+b1 · arm64 · bookworm

      Fixed · Fixed: 3.2.11-1

      dsa · calamares · debian · bookworm; dsa · calamares · debian · 12

    • 3.3.8-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 3.2.11-1

      dsa · calamares · debian · bookworm; dsa · calamares · debian · 12

    • 3.3.8-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 3.2.11-1

      dsa · calamares · debian · bookworm; dsa · calamares · debian · 12

[Debian 13 (Trixie)]

  • [calamares]Fixed
    Details (2)

    • 3.3.14-1 · amd64 · trixie

      Fixed · Fixed: 3.2.11-1

      dsa · calamares · debian · 13

    • 3.3.14-1 · arm64 · trixie

      Fixed · Fixed: 3.2.11-1

      dsa · calamares · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]