Moderate Security Vulnerability in pcs Package: REXML ReDoS (CVE-2024-49761)
Summary
RLSA-2025:11047: Moderate: pcs security update. Affects pcs versions < 0:0.10.18-2.el8_10.6. Fixed in 0:0.10.18-2.el8_10.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker/Corosync Configuration System) package provides a command-line interface for configuring and managing the Pacemaker and Corosync utilities, which are essential for high-availability clustering in Linux environments. This package is widely used in enterprise settings to ensure that critical services remain operational even in the event of hardware or software failures. The pcs package is part of the Rocky Linux ecosystem, specifically version 8, and is crucial for maintaining system reliability and performance.
Vulnerability Detail
The vulnerability identified as CVE-2024-49761 is a Regular Expression Denial of Service (ReDoS) issue found in the rexml library used by the pcs package. This vulnerability arises from the way certain regular expressions are processed, allowing an attacker to craft input that takes an excessive amount of time to process, potentially leading to denial of service. The ramifications of this vulnerability can be significant, as it may allow an attacker to disrupt the availability of services managed by the pcs package, impacting overall system performance and reliability.
How To Fix
Minimum fixed version
0:0.10.18-2.el8_10.6
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the input size to the pcs commands to mitigate the risk of triggering the ReDoS vulnerability. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The pcs package has a moderate security vulnerability (CVE-2024-49761) that can lead to denial of service through a ReDoS attack. It is crucial for users to update to the patched version to ensure system reliability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for pcs →
FAQ
CVE-2024-49761 is a vulnerability in the pcs package that allows for a Regular Expression Denial of Service (ReDoS) attack, potentially disrupting service availability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability can lead to denial of service, causing critical services managed by the pcs package to become unavailable.
Yes, a patched version of the pcs package is available. Update to version 0:0.10.18-2.el8_10.6 or later to mitigate the vulnerability.
If immediate updating is not possible, consider limiting input sizes to pcs commands as a temporary workaround until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
