CVE-2019-13178

modules/luksbootkeyfile/main.py in Calamares through 3.2.4 has a race condition between the time...

8.1 HighFix available

modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.69%Down 1.4 points since Apr 14, 2021

What each source reports

NVD Score used 8.1

modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Record: CVE-2019-13178
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-362
Updated: 2026-11-02

CVE List No score

modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Record: CVE-2019-13178
Updated: 2026-11-02

EUVDEUVD-2019-4702 No score

modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Record: EUVD-2019-4702
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j52x-jwvh-c5gg 8.1

modules/luksbootkeyfile/main.py in Calamares through 3.2.4 has a race condition between the time...

modules/luksbootkeyfile/main.py in Calamares through 3.2.4 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Record: GHSA-j52x-jwvh-c5gg
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362
Updated: 2026-11-02

OSV 8.1

modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Record: CVE-2019-13178
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-13178 8.1

modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Record: DEBIAN-CVE-2019-13178
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVUBUNTU-CVE-2019-13178 8.1

modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.

Record: UBUNTU-CVE-2019-13178
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2019:2628-1 No score

Security update for calamares

This update for calamares fixes the following issues:

Launch with 'pkexec calamares' in openSUSE Tumbleweed, but launch with 'xdg-su -c calamares' in openSUSE Leap 15.

Update to Calamares 3.2.15:

'displaymanager' module now treats 'sysconfig' as a regular entry in the 'displaymanagers' list, and the 'sysconfigSetup' key is used as a shorthand to force only that entry in the list.
'machineid' module has been re-written in C++ and extended with a new configuration key to generate urandom pool data.
'unpackfs' now supports a special 'sourcefs' value of file for copying single files (optionally with renaming) or directory trees to the target system.
'unpackfs' now support an 'exclude' and 'excludeFile' setting for excluding particular files or patters from unpacking.

Update to Calamares 3.2.14:

'locale' module no longer recognizes the legacy GeoIP configuration. This has been deprecated since Calamares 3.2.8 and is now removed.
'packagechooser' module can now be custom-labeled in the overall progress (left-hand column).
'displaymanager' module now recognizes KDE Plasma 5.17.
'displaymanager' module now can handle Wayland sessions and can detect sessions from their .desktop files.
'unpackfs' now has special handling for sourcefs setting “file”.

Update to Calamares 3.2.13.

More about upstream changes:

https://calamares.io/calamares-3.2.13-is-out/ and https://calamares.io/calamares-3.2.12-is-out/

Update to Calamares 3.2.11:

Fix race condition in modules/luksbootkeyfile/main.py (boo#1140256, CVE-2019-13178)
more about upstream changes in 3.2 versions can be found in https://calamares.io/ and https://github.com/calamares/calamares/releases

Record: openSUSE-SU-2019:2628-1
Updated: 2026-11-02

OSVopenSUSE-SU-2019:2654-1 No score

Security update for calamares

This update for calamares fixes the following issues:

Launch with 'pkexec calamares' in openSUSE Tumbleweed, but launch with 'xdg-su -c calamares' in openSUSE Leap 15.

Update to Calamares 3.2.15:

'displaymanager' module now treats 'sysconfig' as a regular entry in the 'displaymanagers' list, and the 'sysconfigSetup' key is used as a shorthand to force only that entry in the list.
'machineid' module has been re-written in C++ and extended with a new configuration key to generate urandom pool data.
'unpackfs' now supports a special 'sourcefs' value of file for copying single files (optionally with renaming) or directory trees to the target system.
'unpackfs' now support an 'exclude' and 'excludeFile' setting for excluding particular files or patters from unpacking.

Update to Calamares 3.2.14:

'locale' module no longer recognizes the legacy GeoIP configuration. This has been deprecated since Calamares 3.2.8 and is now removed.
'packagechooser' module can now be custom-labeled in the overall progress (left-hand column).
'displaymanager' module now recognizes KDE Plasma 5.17.
'displaymanager' module now can handle Wayland sessions and can detect sessions from their .desktop files.
'unpackfs' now has special handling for sourcefs setting “file”.

Update to Calamares 3.2.13.

More about upstream changes:

https://calamares.io/calamares-3.2.13-is-out/ and https://calamares.io/calamares-3.2.12-is-out/

Update to Calamares 3.2.11:

Fix race condition in modules/luksbootkeyfile/main.py (boo#1140256, CVE-2019-13178)
more about upstream changes in 3.2 versions can be found in https://calamares.io/ and https://github.com/calamares/calamares/releases

This update was imported from the openSUSE:Leap:15.0:Update update project.

Record: openSUSE-SU-2019:2654-1
Updated: 2026-11-02

OSVopenSUSE-SU-2019:2655-1 No score

Security update for calamares

This update for calamares fixes the following issues:

Launch with 'pkexec calamares' in openSUSE Tumbleweed, but launch with 'xdg-su -c calamares' in openSUSE Leap 15.

Update to Calamares 3.2.15:

'displaymanager' module now treats 'sysconfig' as a regular entry in the 'displaymanagers' list, and the 'sysconfigSetup' key is used as a shorthand to force only that entry in the list.
'machineid' module has been re-written in C++ and extended with a new configuration key to generate urandom pool data.
'unpackfs' now supports a special 'sourcefs' value of file for copying single files (optionally with renaming) or directory trees to the target system.
'unpackfs' now support an 'exclude' and 'excludeFile' setting for excluding particular files or patters from unpacking.

Update to Calamares 3.2.14:

'locale' module no longer recognizes the legacy GeoIP configuration. This has been deprecated since Calamares 3.2.8 and is now removed.
'packagechooser' module can now be custom-labeled in the overall progress (left-hand column).
'displaymanager' module now recognizes KDE Plasma 5.17.
'displaymanager' module now can handle Wayland sessions and can detect sessions from their .desktop files.
'unpackfs' now has special handling for sourcefs setting “file”.

Update to Calamares 3.2.13.

More about upstream changes:

https://calamares.io/calamares-3.2.13-is-out/ and https://calamares.io/calamares-3.2.12-is-out/

Update to Calamares 3.2.11:

Fix race condition in modules/luksbootkeyfile/main.py (boo#1140256, CVE-2019-13178)
more about upstream changes in 3.2 versions can be found in https://calamares.io/ and https://github.com/calamares/calamares/releases

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record: openSUSE-SU-2019:2655-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10672-1 No score

calamares-3.2.36-1.6 on GA media

These are all security issues fixed in the calamares-3.2.36-1.6 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10672-1
Updated: 2026-11-02

Affected products

calamares

Affected packages

Affected packages
Package	Affected	Fixed
`calamares` Debian:12	before 3.2.11-1	3.2.11-1
`calamares` Debian:13	before 3.2.11-1	3.2.11-1
`calamares` Debian:14	before 3.2.11-1	3.2.11-1
`calamares` Ubuntu:18.04:LTS	All versions, plus listed versions 3.1.7-13.1.7-23.1.8-0ubuntu13.1.8-13.1.9-13.1.10-13.1.12-0ubuntu13.1.12-1	None known
`calamares` Ubuntu:20.04:LTS	All versions, plus listed versions 3.2.14-0ubuntu23.2.14-0ubuntu33.2.17.1-0ubuntu13.2.17.1-0ubuntu23.2.17.1-0ubuntu4 Show 5 moreShow less 3.2.17.1-0ubuntu53.2.18-0ubuntu13.2.19-0ubuntu13.2.19.1-0ubuntu13.2.20-0ubuntu1	None known
`calamares` Ubuntu:22.04:LTS	All versions, plus listed versions 3.2.41.1-0ubuntu13.2.41.1-0ubuntu23.2.41.1-0ubuntu33.2.41.1-0ubuntu43.2.60-0ubuntu0.13.2.61-0ubuntu0.1	None known
`calamares` openSUSE:Leap 15.0	before 3.2.15-lp151.4.3.3	3.2.15-lp151.4.3.3
`calamares` openSUSE:Leap 15.1	before 3.2.15-lp151.4.3.3	3.2.15-lp151.4.3.3
`calamares` SUSE:Package Hub 15	before 3.2.15-bp150.2.6.1	3.2.15-bp150.2.6.1
`calamares` SUSE:Package Hub 15 SP1	before 3.2.15-bp151.4.3.1	3.2.15-bp151.4.3.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-13178 is a high vulnerability (CVSS 8.1) in Calamares, published July 2, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in calamares 3.2.11-1.

References

Show 19 moreShow less