Low: pcs security, bug fix, and enhancement update - Cross-site scripting (XSS) and untrusted code execution
Summary
ALSA-2021:4142: Low: pcs security, bug fix, and enhancement update. Affects pcs versions < 0.10.10-4.el8.alma. Fixed in 0.10.10-4.el8.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. It is used to manage and configure high-availability clusters. The package allows users to control and monitor cluster resources, configure fencing, and perform other administrative tasks. The vulnerability affects the pcs package in AlmaLinux 8.
Vulnerability Detail
The vulnerability includes two security issues:
-
Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656): This vulnerability allows an attacker to inject malicious scripts into web pages viewed by users. By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
-
Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023): This vulnerability allows an attacker to execute untrusted code by manipulating the <option> tag in HTML passed to DOM manipulation methods. By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the victim's browser, potentially leading to remote code execution or other malicious activities.
How To Fix
Minimum fixed version
0.10.10-4.el8.alma
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The pcs package in AlmaLinux 8 is affected by two security vulnerabilities: Cross-site scripting (XSS) and untrusted code execution. To mitigate these vulnerabilities, it is crucial to update the pcs package to version 0.10.10-4.el8.alma or later. This update includes the necessary security fixes. It is also recommended to follow secure coding practices and input validation techniques to prevent similar vulnerabilities in the future. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pcs →
FAQ
The XSS vulnerability allows an attacker to inject malicious scripts into web pages viewed by users. This can lead to various consequences, such as session hijacking, data theft, defacement of websites, or the execution of arbitrary code in the context of the victim's browser.
The untrusted code execution vulnerability allows an attacker to execute untrusted code in the context of the victim's browser. This can lead to various consequences, such as remote code execution, unauthorized access to sensitive information, or the manipulation of web page content.
The recommended mitigation is to update the pcs package to the latest version, which includes the necessary security fixes. Additionally, it is important to follow secure coding practices and input validation techniques to prevent XSS and untrusted code execution vulnerabilities.
There is no evidence of active exploitation of these vulnerabilities at the moment. However, it is always recommended to apply security updates promptly to mitigate potential risks.
You can find more information about these vulnerabilities, including the impact, CVSS score, and other related details, on the CVE pages: CVE-2020-7656 and CVE-2020-11023.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
