Moderate: pcs security, bug fix, and enhancement update
Summary
ALSA-2022:7447: Moderate: pcs security, bug fix, and enhancement update. Affects pcs versions < 0.10.14-5.el8.alma. Fixed in 0.10.14-5.el8.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. It is used to manage and configure high-availability clusters. The package allows administrators to configure and control the behavior of the cluster and its resources.
Vulnerability Detail
The vulnerability identified in this update is related to improper authentication via PAM in the pcs package. This vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access to the cluster configuration. The impact of this vulnerability could result in unauthorized changes to the cluster configuration, leading to potential disruption or compromise of the cluster's availability and integrity.
How To Fix
Minimum fixed version
0.10.14-5.el8.alma
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the pcs package has been found to have a vulnerability related to improper authentication via PAM. It is recommended to update the package to the latest version to mitigate the risk of unauthorized access and potential compromise of the cluster configuration. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pcs →
FAQ
The pcs package provides a command-line configuration system for managing and configuring high-availability clusters using Pacemaker and Corosync utilities.
The vulnerability allows for improper authentication via PAM, which could lead to unauthorized access and potential compromise of the cluster configuration.
To fix the vulnerability, update the pcs package to version 0.10.14-5.el8.alma or later.
No, there are no known workarounds for this vulnerability. It is recommended to update the package to the latest version.
More information about this vulnerability can be found in the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
