{"id":"CVE-2018-1084","aliases":["DEBIAN-CVE-2018-1084","DSA-4174-1","EUVD-2018-11734","GHSA-4gvp-pc33-4ccc","MGASA-2018-0275","RHSA-2018:1169","SUSE-SU-2018:1121-1","SUSE-SU-2018:1130-1","UBUNTU-CVE-2018-1084","USN-4000-1","openSUSE-SU-2024:10695-1"],"status":"published","title":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","description":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.03113,"percentile":0.87891,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2018-04-12T00:00:00Z","modified":"2026-10-24T14:05:16Z","fixes":[{"ecosystem":"Debian:12","package":"corosync","fixed_in":["2.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"corosync","fixed_in":["2.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"corosync","fixed_in":["2.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"corosync","fixed_in":["2.4.2-3+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"corosync","fixed_in":["2.3.5-2.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosync","fixed_in":["0:2.4.3-2.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosync-debuginfo","fixed_in":["0:2.4.3-2.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosync-qdevice","fixed_in":["0:2.4.3-2.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosync-qnetd","fixed_in":["0:2.4.3-2.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosynclib","fixed_in":["0:2.4.3-2.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosynclib-devel","fixed_in":["0:2.4.3-2.el7_5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"corosync","fixed_in":["2.3.6-9.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"corosync","fixed_in":["2.3.6-9.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP2","package":"corosync","fixed_in":["2.3.5-6.23.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"corosync","fixed_in":["2.3.5-3ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"corosync","fixed_in":["2.4.3-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"corosync","fixed_in":["2.4.5+git70.64010f57-1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3+deb9u1"}]}],"versions":["2.4.2-3","2.4.2-3+deb9u1~bpo8+1"]},{"source":"osv","ecosystem":"Mageia:6","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5-2.1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-2.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-2.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosync-qdevice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-2.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosync-qnetd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-2.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosynclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-2.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"corosynclib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.3-2.el7_5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-9.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-9.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP2","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5-6.23.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5-3ubuntu2.3"}]}],"versions":["2.3.4-0ubuntu1","2.3.5-3","2.3.5-3ubuntu1","2.3.5-3ubuntu2","2.3.5-3ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-0ubuntu1.1"}]}],"versions":["2.4.2-3build1","2.4.2-3ubuntu1","2.4.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5-3ubuntu2.3"}]}],"versions":["2.3.4-0ubuntu1","2.3.5-3","2.3.5-3ubuntu1","2.3.5-3ubuntu2","2.3.5-3ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-0ubuntu1.1"}]}],"versions":["2.4.2-3build1","2.4.2-3ubuntu1","2.4.3-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"corosync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5+git70.64010f57-1.2"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"corosync","product":"corosync"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"unspecified","product":"corosync"}],"references":[{"url":"http://www.securityfocus.com/bid/103758","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1084","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://www.debian.org/security/2018/dsa-4174","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1169","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4000-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202107-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1084","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4gvp-pc33-4ccc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1084","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0275.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22905","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2018/04/12/2","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1552830","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1169.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1084","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181121-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1066585","tags":["report"]},{"url":"https://bugzilla.suse.com/1083561","tags":["report"]},{"url":"https://bugzilla.suse.com/1089346","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1084","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181130-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1083030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1084","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/04/12/2","tags":["report"]},{"url":"https://oss.clusterlabs.org/pipermail/users/2018-April/014856.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4000-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1084","description":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","status":"published","published":"2018-04-12T17:00:00Z","modified":"2024-08-05T03:51:48.451Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-11734","description":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","status":"published","published":"2018-04-12T17:00:00Z","modified":"2024-08-05T03:51:48Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:16.874515Z"}],"ghsa":[{"id":"GHSA-4gvp-pc33-4ccc","title":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","description":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","status":"published","published":"2022-05-13T01:08:56Z","modified":"2023-01-31T21:31:28Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:49:32.359752Z"}],"nvd":[{"id":"CVE-2018-1084","description":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","status":"published","published":"2018-04-12T17:29:00.297Z","modified":"2026-06-17T01:50:26.64Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:04:25.506659Z"}],"osv":[{"id":"CVE-2018-1084","description":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","status":"published","published":"2018-04-12T17:29:00.297Z","modified":"2026-10-24T14:05:16.838433585Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1084","description":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","status":"published","published":"2018-04-12T17:29:00.297Z","modified":"2026-10-23T18:03:47.144072802Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:1169","title":"Red Hat Security Advisory: corosync security update","status":"published","published":"2024-09-16T01:05:11Z","modified":"2026-07-01T10:03:36Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2018-1084","description":"corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.","status":"published","published":"2018-04-12T00:00:00Z","modified":"2026-04-22T11:40:35.490465Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DSA-4174-1","title":"corosync - security update","status":"published","published":"2018-04-17T00:00:00Z","modified":"2026-03-09T01:21:32.244902Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0275","title":"Updated corosync packages fix security vulnerability","description":"An integer overflow leading to an out-of-bound read was found in\nauthenticate_nss_2_3() in Corosync. An attacker could craft a malicious\npacket that would lead to a denial of service (CVE-2018-1084).\n","status":"published","published":"2018-06-06T18:15:31Z","modified":"2026-04-16T06:23:48.058590666Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10695-1","title":"corosync-2.4.5+git70.64010f57-1.2 on GA media","description":"These are all security issues fixed in the corosync-2.4.5+git70.64010f57-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:14:44.93316Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:1121-1","title":"Security update for corosync","description":"This update for corosync fixes the following issue:\n- CVE-2018-1084: Integer overflow in totemcrypto:authenticate_nss_2_3() could lead to command execution (bsc#1089346)\n- Providing an empty uid or gid results in coroparse adding uid 0. (bsc#1066585)\n- Fix a problem with configuration file incompatibilities that was causing corosync to not\n  work after upgrading from SLE-11-SP4-HA to SLE-12/15-HA. (bsc#1083561)\n","status":"published","published":"2018-05-02T06:02:49Z","modified":"2026-02-04T04:08:50.634577Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1130-1","title":"Security update for corosync","description":"This update for corosync provides the following fixes:\n    \n- CVE-2018-1084: Integer overflow in totemcrypto:authenticate_nss_2_3() could lead to command execution (bsc#1089346)\n- Providing an empty uid or gid results in coroparse adding uid 0. (bsc#1066585)\n- Fix a problem that was causing corosync memory to increase on ring breakup. (bsc#1083030)\n- Fix a problem with configuration file incompatibilities that was causing corosync to not\n  work after upgrading from SLE-11-SP4-HA to SLE-12/15-HA. (bsc#1083561)\n","status":"published","published":"2018-05-02T13:49:52Z","modified":"2026-02-04T04:11:20.035134Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-4000-1","title":"corosync vulnerability","description":"It was discovered that Corosync incorrectly handled certain requests.\nAn attacker could possibly use this issue to cause a denial of service\nor execute arbitrary code.\n","status":"published","published":"2019-05-30T15:03:11Z","modified":"2026-04-22T09:57:12.419929Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}