Security Update for Resource-Agents: Mitigating .netrc Credentials Leak Vulnerability
Summary
ALSA-2025:14999: Moderate: resource-agents security update. Affects resource-agents versions < 4.9.0-54.el8_10.16. Fixed in 4.9.0-54.el8_10.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The resource-agents package is essential for managing high-availability (HA) environments, providing scripts that interface with various services through Pacemaker and RGManager service managers. This package is crucial for ensuring that services remain operational and can recover from failures. However, it has been found to be vulnerable to a security issue that could expose sensitive credentials.
Vulnerability Detail
The vulnerability identified as CVE-2024-47081 pertains to a leak of .netrc credentials through malicious URLs. This issue arises when the resource-agents package processes URLs that can be manipulated by an attacker to extract sensitive information stored in the .netrc file, potentially leading to unauthorized access to services and data. The implications of this vulnerability are significant, as it could compromise the security of the entire high-availability environment.
How To Fix
Minimum fixed version
4.9.0-54.el8_10.16
This is the first release that contains the fix.
sudo dnf update resource-agentsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict input validation on URLs processed by the resource-agents package to mitigate the risk of credential leakage. Additionally, avoid using .netrc files for sensitive credentials until the update is applied.
Conclusion
The resource-agents package has a moderate vulnerability that can lead to credential leakage through malicious URLs. It is crucial to update to the patched version to ensure the security of your high-availability environment. In the meantime, consider implementing workarounds to mitigate risks.
See every vulnerability recorded for resource-agents →
FAQ
CVE-2024-47081 is a vulnerability in the resource-agents package that allows for the leakage of .netrc credentials through malicious URLs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to services and sensitive data, compromising the security of the high-availability environment.
Yes, a patch is available in version 4.9.0-54.el8_10.16 of the resource-agents package.
Implement strict input validation on URLs and avoid using .netrc files for sensitive credentials until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for resource-agents.
