Critical Security Flaw in pcs Package: Important Update Required
Summary
ALSA-2025:21036: Important: pcs security update. Affects cockpit-ha-cluster versions < 0.12.1-1.el10_1.1. Fixed in 0.12.1-1.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs package provides a command-line configuration system for the Pacemaker and Corosync utilities, which are essential for managing high-availability clusters. This package allows users to configure and manage cluster resources efficiently. However, recent security vulnerabilities have been identified that could potentially compromise the integrity and availability of systems utilizing this package.
Vulnerability Detail
The pcs package is affected by multiple vulnerabilities stemming from the underlying Rack framework. These include unsafe default parameters that allow for bypassing limits, unbounded multipart preamble buffering leading to denial of service through memory exhaustion, and unbounded reads in form parsing. These vulnerabilities can be exploited by attackers to cause significant disruptions, including service outages and resource exhaustion.
How To Fix
Minimum fixed version
0.12.1-1.el10_1.1
This is the first release that contains the fix.
sudo dnf update cockpit-ha-clusterTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on requests to the pcs service to reduce the risk of denial of service attacks. Additionally, monitor your system for unusual activity that may indicate an attempted exploit.
Conclusion
The pcs package has critical vulnerabilities that require immediate attention. Updating to the latest version is crucial to maintaining the security and stability of systems utilizing this package. Users are encouraged to monitor their applications for vulnerabilities and take proactive measures to mitigate risks.
See every vulnerability recorded for cockpit-ha-cluster →
FAQ
The pcs package is affected by vulnerabilities related to unsafe parameter handling, unbounded memory usage, and denial of service attacks.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
Implement rate limiting on requests and monitor your system for unusual activity to mitigate risks until you can perform the update.
Exploiting these vulnerabilities can lead to denial of service, memory exhaustion, and potential unauthorized access to sensitive data.
For detailed information, refer to the CVE pages associated with the vulnerabilities, such as CVE-2025-59830 and others listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-ha-cluster.
