{"id":"CVE-2019-13178","aliases":["DEBIAN-CVE-2019-13178","EUVD-2019-4702","GHSA-j52x-jwvh-c5gg","UBUNTU-CVE-2019-13178","openSUSE-SU-2019:2628-1","openSUSE-SU-2019:2654-1","openSUSE-SU-2019:2655-1","openSUSE-SU-2024:10672-1"],"status":"published","title":"modules/luksbootkeyfile/main.py in Calamares through 3.2.4 has a race condition between the time...","description":"modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01692,"percentile":0.7726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2019-07-02T22:43:24Z","modified":"2026-10-20T10:50:42Z","fixes":[{"ecosystem":"Debian:12","package":"calamares","fixed_in":["3.2.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"calamares","fixed_in":["3.2.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"calamares","fixed_in":["3.2.11-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"calamares","fixed_in":["3.2.15-lp151.4.3.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"calamares","fixed_in":["3.2.15-lp151.4.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"calamares","fixed_in":["3.2.15-bp150.2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"calamares","fixed_in":["3.2.15-bp151.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.11-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7-1","3.1.7-2","3.1.8-0ubuntu1","3.1.8-1","3.1.9-1","3.1.10-1","3.1.12-0ubuntu1","3.1.12-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.14-0ubuntu2","3.2.14-0ubuntu3","3.2.17.1-0ubuntu1","3.2.17.1-0ubuntu2","3.2.17.1-0ubuntu4","3.2.17.1-0ubuntu5","3.2.18-0ubuntu1","3.2.19-0ubuntu1","3.2.19.1-0ubuntu1","3.2.20-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.41.1-0ubuntu1","3.2.41.1-0ubuntu2","3.2.41.1-0ubuntu3","3.2.41.1-0ubuntu4","3.2.60-0ubuntu0.1","3.2.61-0ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-lp151.4.3.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-lp151.4.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-bp150.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"calamares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-bp151.4.3.1"}]}]}],"products":[{"vendor":"calamares","product":"calamares"}],"references":[{"url":"https://github.com/calamares/calamares/issues/1190","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.pavelkogan.com/2015/01/25/linux-mint-encryption/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/calamares/calamares/issues/1191","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726565","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://calamares.io/calamares-3.2.11-is-out/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://calamares.io/calamares-cve-2019/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13178"},{"url":"https://calamares.io/calamares-3.2.11-is-out"},{"url":"https://calamares.io/calamares-cve-2019"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC"},{"url":"https://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption"},{"url":"https://www.pavelkogan.com/2015/01/25/linux-mint-encryption"},{"url":"https://github.com/advisories/GHSA-j52x-jwvh-c5gg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13178","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13178","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F37KTDMSUVC5W6DQSVTR4KZ7P2V4DLGL/#F37KTDMSUVC5W6DQSVTR4KZ7P2V4DLGL","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1140256","tags":["report"]},{"url":"https://bugzilla.suse.com/1152377","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13178","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OU7DMCEKVGL42QYWSNT6IENE4JIKRXYA/#OU7DMCEKVGL42QYWSNT6IENE4JIKRXYA","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4TOLBXDJOI3P5ENJK3LMN4VDQM4USKW3/#4TOLBXDJOI3P5ENJK3LMN4VDQM4USKW3","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-13178","description":"modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","status":"published","published":"2019-07-02T22:43:24Z","modified":"2024-08-04T23:41:10.699Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-4702","description":"modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","status":"published","published":"2019-07-02T22:43:24Z","modified":"2024-08-04T23:41:10Z","updated_at":"2026-11-03T02:40:43.368399Z"}],"ghsa":[{"id":"GHSA-j52x-jwvh-c5gg","title":"modules/luksbootkeyfile/main.py in Calamares through 3.2.4 has a race condition between the time...","description":"modules/luksbootkeyfile/main.py in Calamares through 3.2.4 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","status":"published","published":"2022-05-24T16:49:22Z","modified":"2024-04-04T01:10:32Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:55:55.605227Z"}],"nvd":[{"id":"CVE-2019-13178","description":"modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","status":"published","published":"2019-07-02T23:15:09.83Z","modified":"2026-06-17T02:16:13.727Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:05:17.695191Z"}],"osv":[{"id":"CVE-2019-13178","description":"modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","status":"published","published":"2019-07-02T23:15:09.83Z","modified":"2026-10-20T10:50:42.381039549Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13178","description":"modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","status":"published","published":"2019-07-02T23:15:09.83Z","modified":"2026-09-21T07:02:18.265737067Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13178","description":"modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","status":"published","published":"2019-07-02T23:15:00Z","modified":"2025-10-24T04:47:42Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"openSUSE-SU-2019:2628-1","title":"Security update for calamares","description":"This update for calamares fixes the following issues:\n\n- Launch with 'pkexec calamares' in openSUSE Tumbleweed, but\n  launch with 'xdg-su -c calamares' in openSUSE Leap 15.\n\nUpdate to Calamares 3.2.15:\n\n- 'displaymanager' module now treats 'sysconfig' as a regular \n  entry in the 'displaymanagers' list, and the 'sysconfigSetup' \n  key is used as a shorthand to force only that entry in the \n  list.\n- 'machineid' module has been re-written in C++ and extended \n  with a new configuration key to generate urandom pool data.\n- 'unpackfs' now supports a special 'sourcefs' value of file \n  for copying single files (optionally with renaming) or \n  directory trees to the target system.\n- 'unpackfs' now support an 'exclude' and 'excludeFile' setting \n  for excluding particular files or patters from unpacking.\n\nUpdate to Calamares 3.2.14:\n- 'locale' module no longer recognizes the legacy GeoIP \n  configuration. This has been deprecated since Calamares 3.2.8 \n  and is now removed.\n- 'packagechooser' module can now be custom-labeled in the overall\n  progress (left-hand column).\n- 'displaymanager' module now recognizes KDE Plasma 5.17.\n- 'displaymanager' module now can handle Wayland sessions and can\n  detect sessions from their .desktop files.\n- 'unpackfs' now has special handling for sourcefs setting “file”. \n\nUpdate to Calamares 3.2.13.\n\nMore about upstream changes:\n\n  https://calamares.io/calamares-3.2.13-is-out/ and\n  https://calamares.io/calamares-3.2.12-is-out/\n\nUpdate to Calamares 3.2.11:\n\n- Fix race condition in modules/luksbootkeyfile/main.py \n  (boo#1140256, CVE-2019-13178)\n- more about upstream changes in 3.2 versions can be found in \n  https://calamares.io/ and \n  https://github.com/calamares/calamares/releases\n\n","status":"published","published":"2019-12-03T14:50:29Z","modified":"2026-02-04T04:18:07.75046Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2654-1","title":"Security update for calamares","description":"This update for calamares fixes the following issues:\n\n- Launch with 'pkexec calamares' in openSUSE Tumbleweed, but\n  launch with 'xdg-su -c calamares' in openSUSE Leap 15.\n\nUpdate to Calamares 3.2.15:\n\n- 'displaymanager' module now treats 'sysconfig' as a regular \n  entry in the 'displaymanagers' list, and the 'sysconfigSetup' \n  key is used as a shorthand to force only that entry in the \n  list.\n- 'machineid' module has been re-written in C++ and extended \n  with a new configuration key to generate urandom pool data.\n- 'unpackfs' now supports a special 'sourcefs' value of file \n  for copying single files (optionally with renaming) or \n  directory trees to the target system.\n- 'unpackfs' now support an 'exclude' and 'excludeFile' setting \n  for excluding particular files or patters from unpacking.\n\nUpdate to Calamares 3.2.14:\n- 'locale' module no longer recognizes the legacy GeoIP \n  configuration. This has been deprecated since Calamares 3.2.8 \n  and is now removed.\n- 'packagechooser' module can now be custom-labeled in the overall\n  progress (left-hand column).\n- 'displaymanager' module now recognizes KDE Plasma 5.17.\n- 'displaymanager' module now can handle Wayland sessions and can\n  detect sessions from their .desktop files.\n- 'unpackfs' now has special handling for sourcefs setting “file”. \n\nUpdate to Calamares 3.2.13.\n\nMore about upstream changes:\n\n  https://calamares.io/calamares-3.2.13-is-out/ and\n  https://calamares.io/calamares-3.2.12-is-out/\n\nUpdate to Calamares 3.2.11:\n\n- Fix race condition in modules/luksbootkeyfile/main.py \n  (boo#1140256, CVE-2019-13178)\n- more about upstream changes in 3.2 versions can be found in \n  https://calamares.io/ and \n  https://github.com/calamares/calamares/releases\n\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-12-09T11:20:27Z","modified":"2026-02-04T04:33:21.302849Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2655-1","title":"Security update for calamares","description":"This update for calamares fixes the following issues:\n\n- Launch with 'pkexec calamares' in openSUSE Tumbleweed, but\n  launch with 'xdg-su -c calamares' in openSUSE Leap 15.\n\nUpdate to Calamares 3.2.15:\n\n- 'displaymanager' module now treats 'sysconfig' as a regular \n  entry in the 'displaymanagers' list, and the 'sysconfigSetup' \n  key is used as a shorthand to force only that entry in the \n  list.\n- 'machineid' module has been re-written in C++ and extended \n  with a new configuration key to generate urandom pool data.\n- 'unpackfs' now supports a special 'sourcefs' value of file \n  for copying single files (optionally with renaming) or \n  directory trees to the target system.\n- 'unpackfs' now support an 'exclude' and 'excludeFile' setting \n  for excluding particular files or patters from unpacking.\n\nUpdate to Calamares 3.2.14:\n- 'locale' module no longer recognizes the legacy GeoIP \n  configuration. This has been deprecated since Calamares 3.2.8 \n  and is now removed.\n- 'packagechooser' module can now be custom-labeled in the overall\n  progress (left-hand column).\n- 'displaymanager' module now recognizes KDE Plasma 5.17.\n- 'displaymanager' module now can handle Wayland sessions and can\n  detect sessions from their .desktop files.\n- 'unpackfs' now has special handling for sourcefs setting “file”. \n\nUpdate to Calamares 3.2.13.\n\nMore about upstream changes:\n\n  https://calamares.io/calamares-3.2.13-is-out/ and\n  https://calamares.io/calamares-3.2.12-is-out/\n\nUpdate to Calamares 3.2.11:\n\n- Fix race condition in modules/luksbootkeyfile/main.py \n  (boo#1140256, CVE-2019-13178)\n- more about upstream changes in 3.2 versions can be found in \n  https://calamares.io/ and \n  https://github.com/calamares/calamares/releases\n\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-12-09T11:20:42Z","modified":"2026-02-04T02:21:07.983638Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10672-1","title":"calamares-3.2.36-1.6 on GA media","description":"These are all security issues fixed in the calamares-3.2.36-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:49.513262Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}