Moderate: pcs security update
Summary
RLSA-2023:0855: Moderate: pcs security update. Affects pcs versions < 0:0.10.14-5.el8_7.2. Fixed in 0:0.10.14-5.el8_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. It is used to manage and configure high-availability clusters. The package allows users to control and monitor cluster resources, configure fencing, and manage cluster nodes. The vulnerability affects the pcs package in Rocky Linux 8.
Vulnerability Detail
The vulnerability, identified as CVE-2022-45442, is a Reflected File Download (RFD) attack in the sinatra component. This type of attack tricks a user into downloading a file from a trusted domain that is actually controlled by an attacker. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code on the victim's system, potentially leading to remote code execution, data theft, or other malicious activities. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:0.10.14-5.el8_7.2
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the security update as soon as possible to protect the system from potential attacks.
Conclusion
The pcs package in Rocky Linux 8 is affected by a moderate-level vulnerability (CVE-2022-45442) that allows for a Reflected File Download attack. To mitigate this vulnerability, it is crucial to update the pcs package to version 0.10.14-5.el8_7.2 or later. Users can use the Vulert Playground to check if their system is affected and apply the necessary security measures. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pcs →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the victim's system, potentially leading to remote code execution, data theft, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
There is no known exploit available for this vulnerability at the moment. However, it is crucial to apply the security update to prevent any potential attacks.
It is highly recommended to update the pcs package to the latest version provided by the official Rocky Linux repository. Manual patching may not address all the underlying security issues and could leave the system vulnerable to other attacks.
This vulnerability was discovered by the Rocky Enterprise Software Foundation and reported to the relevant maintainers. Red Hat also contributed to the security fix for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
