Moderate Security Vulnerability in pcs and pcs-snmp Packages: REXML ReDoS Issue
Summary
ALSA-2025:11047: Moderate: pcs security update. Affects pcs versions < 0.10.18-2.el8_10.6.alma.1. Fixed in 0.10.18-2.el8_10.6.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker Configuration System) and pcs-snmp packages provide a command-line configuration system for managing the Pacemaker and Corosync utilities, which are essential for high-availability clustering in Linux environments. These packages facilitate the configuration and management of cluster resources, ensuring that services remain available even in the event of a failure. However, a recently identified vulnerability poses a risk to users of these packages, necessitating immediate attention.
Vulnerability Detail
The vulnerability, identified as CVE-2024-49761, is a Regular Expression Denial of Service (ReDoS) issue within the REXML library used by the pcs packages. This vulnerability arises from the way certain regular expressions are processed, allowing an attacker to exploit the system by sending specially crafted input that can cause excessive backtracking. This can lead to significant performance degradation, potentially rendering the service unresponsive. The impact of this vulnerability can be severe, especially in production environments where uptime is critical.
How To Fix
Minimum fixed version
0.10.18-2.el8_10.6.alma.1
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider implementing input validation to filter out potentially malicious input that could exploit the ReDoS vulnerability. However, this is not a substitute for applying the security update.
Conclusion
The pcs and pcs-snmp packages are essential for managing high-availability clusters, but the identified vulnerability (CVE-2024-49761) poses a significant risk. Users are strongly advised to update to the latest patched version to ensure the security and stability of their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for pcs →
FAQ
CVE-2024-49761 is a vulnerability in the REXML library used by the pcs packages, which can lead to a Denial of Service (DoS) due to excessive backtracking in regular expression processing.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file or use the Vulert playground to check if your application is affected by this vulnerability.
The vulnerability can lead to performance degradation and service unavailability, particularly in high-availability environments where the pcs and pcs-snmp packages are critical.
Yes, a patch is available. Users should update to version 0.10.18-2.el8_10.6.alma.1 or later to mitigate the vulnerability.
If immediate updating is not possible, consider implementing input validation as a temporary workaround to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
