CVE-2018-18629 Privilege escalation in n/a

What is CVE-2018-18629?

CVE-2018-18629 is a high-severity vulnerability in n/a, published on 20 Dec 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search path vulnerability in the keybase-redirector application allows a local, unprivileged user on Linux to gain root privileges via a Trojan horse binary.

Weakness: CWE-426

Which versions are affected by CVE-2018-18629?

It affects 1 product.

Products include Keybase Keybase.

How do I fix CVE-2018-18629?

No fix has been published for CVE-2018-18629 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-18629 being exploited?

There is no known exploitation of CVE-2018-18629 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2019-7249 Race condition in n/a Critical 9.8
• CVE-2019-16992 Other in n/a High 7.5
• CVE-2021-34422 Path traversal of file names in Keybase Client for Windows High 7.2
• CVE-2021-23827 Information disclosure in n/a Medium 5.5
• CVE-2021-34426 Arbitrary command execution in Keybase Client for Windows Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r956-7c4h-fwq7.