CVE-2019-13179

Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.

• CWE-522

• https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095Exploit, Issue Tracking, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1726542Issue Tracking, Third Party Advisory
• https://calamares.io/calamares-3.2.11-is-out/Vendor Advisory
• https://calamares.io/calamares-cve-2019/Vendor Advisory
• https://github.com/calamares/calamares/issues/1191Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC/
• https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095Exploit, Issue Tracking, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1726542Issue Tracking, Third Party Advisory
• https://calamares.io/calamares-3.2.11-is-out/Vendor Advisory
• https://calamares.io/calamares-cve-2019/Vendor Advisory
• https://github.com/calamares/calamares/issues/1191Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC/

Published

Jul 2, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13172Some Xerox printers (such as the Phaser 3320 V53.006.16.000)…9.8
• CVE-2019-13173fstream before 1.0.12 is vulnerable to Arbitrary File Overwr…
• CVE-2019-13175Read the Docs before 3.5.1 has an Open Redirect if certain u…
• CVE-2019-13176An issue was discovered in the 3CX Phone system (web) manage…
• CVE-2019-13177verification.py in django-rest-registration (aka Django REST…
• CVE-2019-13178modules/luksbootkeyfile/main.py in Calamares versions 3.1 th…
• CVE-2019-1318A spoofing vulnerability exists when Transport Layer Securit…5.9
• CVE-2019-13181A CSV injection vulnerability exists in the web UI of SolarW…6.5
• CVE-2019-13182A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2019-13183Flarum before 0.1.0-beta.9 allows CSRF against all POST endp…
• CVE-2019-13186In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit…
• CVE-2019-13187The Rich Text Formatter (Redactor) extension through v1.1.1 …