Critical Security Update for pcs and pcs-snmp: HTTP Cookie Parsing DoS Vulnerability
Summary
ALSA-2025:2872: Important: pcs security update. Affects pcs versions < 0.10.18-2.el8_10.4.alma.1. Fixed in 0.10.18-2.el8_10.4.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker Configuration System) package provides a command-line interface for configuring and managing the Pacemaker and Corosync utilities, which are essential for high-availability clustering in Linux environments. The pcs-snmp package extends this functionality by integrating SNMP (Simple Network Management Protocol) capabilities. Both packages are vital for ensuring the reliability and performance of clustered systems, but they are currently vulnerable to a denial-of-service (DoS) attack due to a flaw in the Tornado web framework used for HTTP cookie parsing.
Vulnerability Detail
The vulnerability, identified as CVE-2024-52804, originates from the Tornado web framework, which is utilized by the pcs packages. This flaw allows an attacker to exploit HTTP cookie parsing, potentially leading to a denial-of-service condition. If successfully exploited, this vulnerability could disrupt the availability of services relying on pcs and pcs-snmp, impacting system performance and reliability.
How To Fix
Minimum fixed version
0.10.18-2.el8_10.4.alma.1
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the affected services or implement network-level controls to restrict traffic until the packages are updated. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The pcs and pcs-snmp packages are currently vulnerable to a denial-of-service attack due to a flaw in the Tornado web framework. It is crucial to update these packages to the latest patched version to ensure the security and reliability of your systems. Utilize tools like Vulert to monitor for vulnerabilities in your applications.
See every vulnerability recorded for pcs →
FAQ
CVE-2024-52804 is a vulnerability in the Tornado web framework used by the pcs packages, which allows for HTTP cookie parsing denial-of-service attacks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If exploited, this vulnerability can lead to a denial-of-service condition, disrupting the availability of services that rely on pcs and pcs-snmp.
Yes, a patch is available. Update the pcs and pcs-snmp packages to version 0.10.18-2.el8_10.4.alma.1 or later to fix the vulnerability.
If you cannot update immediately, consider implementing network-level controls to restrict access to the affected services as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
