Important: pcs security update
Summary
ALSA-2022:6314: Important: pcs security update. Affects pcs versions < 0.10.12-6.el8_6.2.alma. Fixed in 0.10.12-6.el8_6.2.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. It is used for managing and configuring high-availability clusters. The package allows administrators to configure and control various aspects of the cluster, such as resource management, node status, and failover settings.
Vulnerability Detail
A vulnerability has been identified in the pcs package that could allow an attacker to escalate privileges. By obtaining an authentication token for the hacluster user, an attacker could gain unauthorized access and perform privileged actions on the cluster. This vulnerability is tracked as CVE-2022-2735 and has been rated as important.
How To Fix
Minimum fixed version
0.10.12-6.el8_6.2.alma
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is important to update the pcs package to the fixed version to mitigate the risk of privilege escalation. Failure to apply the security update could leave the cluster vulnerable to unauthorized access and potential compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pcs →
FAQ
The vulnerability allows an attacker to gain unauthorized access and perform privileged actions on the cluster. This could lead to the compromise of sensitive data, disruption of cluster operations, and potential further attacks on the system.
Users of the pcs package on AlmaLinux 8 systems are affected by this vulnerability. Other Linux distributions or versions may have different package versions and may not be vulnerable to this specific issue.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is always recommended to apply security updates promptly to mitigate any potential risks.
The recommended mitigation is to update the pcs package to the fixed version. Applying the security update will address the vulnerability and prevent potential privilege escalation attacks.
More information about this vulnerability, including the CVE identifier and any additional details, can be found in the CVE page referenced in the References section of this advisory.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
