Important: pcs security update
Summary
ALSA-2022:4661: Important: pcs security update. Affects pcs versions < 0.10.12-6.el8.alma. Fixed in 0.10.12-6.el8.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. It is used to manage and configure high-availability clusters. The package allows users to control and monitor cluster resources, configure cluster nodes, and manage cluster services.
Vulnerability Detail
The vulnerability identified as CVE-2022-29970 affects the pcs package. It is a path traversal vulnerability that allows an attacker to access files outside of the designated public directory when serving static files. This can lead to unauthorized access to sensitive information or the execution of arbitrary code. The impact of this vulnerability can vary depending on the specific configuration and usage of the pcs package.
How To Fix
Minimum fixed version
0.10.12-6.el8.alma
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the pcs package is not exposed to untrusted networks or unauthorized access. Additionally, it is advisable to regularly monitor and review access logs for any suspicious activity.
Conclusion
It is crucial to update the pcs package to the recommended version or later to address the path traversal vulnerability. Regularly applying security updates and following best practices for secure configuration can help protect systems from potential exploitation. For further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pcs →
FAQ
The impact of this vulnerability can vary depending on the specific configuration and usage of the pcs package. It could potentially lead to unauthorized access to sensitive information or the execution of arbitrary code.
You can use the Vulert playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including CVE-2022-29970.
At the time of this advisory, there is no known exploit publicly available for this vulnerability. However, it is always recommended to apply security updates promptly to mitigate any potential risks.
While there is no specific workaround mentioned for this vulnerability, you can mitigate the risk by ensuring that the pcs package is not exposed to untrusted networks or unauthorized access. Regularly monitoring access logs for any suspicious activity can also help identify any potential exploitation attempts.
You can find more information about this vulnerability, including the CVSS score and acknowledgments, on the CVE page for CVE-2022-29970. The link to the CVE page is provided in the References section of the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
