CVE-2019-19041: An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41

This month

HIGH 7.2DOWNGRADEDOWNGRADE

CVE-2019-19041 is a high-severity flaw (CVSS 7.2) affecting lpar2rrd, stor2rrd. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by the underlying system. It is possible to achieve this by modifying the values in the files.SUM file (which are used for integrity control) and injecting

Why this priority

High severity
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.2 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	High
User interaction	None
EPSS exploit chance	2.0% (top 19%)
CISA exploited list	No
Weakness	CWE-78
Published	2019-11-17
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: xorur

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-11-17 21:15 UTCPublished CVE record published
2026-06-17 02:26 UTCUpdated Record last modified

xorur lpar2rrd DOWNGRADE

Affected: 6.11

Fixed in: no fixed release known

Safe to downgrade to: a release before 6.11

1. Check installed version

apt-cache policy lpar2rrd || rpm -q lpar2rrd || lpar2rrd --version

2. No fixed release: DOWNGRADE to a release before 6.11 (Debian / Ubuntu)

apt-cache madison lpar2rrd sudo apt install lpar2rrd=<VERSION_BEFORE_6.11> sudo apt-mark hold lpar2rrd

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list lpar2rrd sudo dnf downgrade lpar2rrd-<VERSION_BEFORE_6.11> sudo dnf versionlock add lpar2rrd

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

xorur stor2rrd DOWNGRADE

Affected: 2.61

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.61

1. Check installed version

apt-cache policy stor2rrd || rpm -q stor2rrd || stor2rrd --version

2. No fixed release: DOWNGRADE to a release before 2.61 (Debian / Ubuntu)

apt-cache madison stor2rrd sudo apt install stor2rrd=<VERSION_BEFORE_2.61> sudo apt-mark hold stor2rrd

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list stor2rrd sudo dnf downgrade stor2rrd-<VERSION_BEFORE_2.61> sudo dnf versionlock add stor2rrd

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-19041?

lpar2rrd: downgrade or apply the listed mitigation; stor2rrd: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-19041 being exploited?

CVE-2019-19041 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-19041 affect?

CVE-2019-19041 affects lpar2rrd, stor2rrd. Severity is high (CVSS 7.2). An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to

How urgent is CVE-2019-19041?

Priority 50/100. High severity; Public exploit reference

Related CVEs

CVE-2025-54769 HIGH 8.8 UPGRADE An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file
CVE-2025-54768 MEDIUM 5.3 UPGRADE An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lo
CVE-2025-54767 MEDIUM 6.5 UPGRADE An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as th
CVE-2021-42372 HIGH 8.8 UPGRADE UPGRADE A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows au
CVE-2021-42371 CRITICAL 9.8 UPGRADE UPGRADE lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.

References

← Back to latest CVEs