Moderate: pcs security update
Summary
ALSA-2023:0855: Moderate: pcs security update. Affects pcs versions < 0.10.14-5.el8_7.2.alma. Fixed in 0.10.14-5.el8_7.2.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Pacemaker is an open-source high-availability cluster resource manager, while Corosync is a messaging layer for cluster services. The pcs package allows users to configure and manage these utilities through a command-line interface.
Vulnerability Detail
The vulnerability identified as CVE-2022-45442 affects the pcs package. It is categorized as a Reflected File Download (RFD) attack. This type of attack occurs when an attacker tricks a user into downloading a file from a trusted domain, which can lead to the execution of malicious code. The impact of this vulnerability can vary depending on the specific context in which the pcs package is used. It is important to note that this vulnerability has a moderate severity rating.
How To Fix
Minimum fixed version
0.10.14-5.el8_7.2.alma
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the pcs package is vulnerable to a Reflected File Download attack. To mitigate this vulnerability, it is crucial to update the package to version 0.10.14-5.el8_7.2.alma or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pcs →
FAQ
The pcs package provides a command-line configuration system for the Pacemaker and Corosync utilities, allowing users to manage high-availability clusters.
A Reflected File Download attack occurs when an attacker tricks a user into downloading a file from a trusted domain, potentially leading to the execution of malicious code.
This vulnerability has a moderate severity rating.
To fix this vulnerability, update the pcs package to version 0.10.14-5.el8_7.2.alma or later.
Users can obtain the updated package from the official AlmaLinux repositories or through their preferred package manager.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
