Critical Security Update for pcs Package: HTTP Cookie Parsing DoS Vulnerability
Summary
RLSA-2025:2471: Important: pcs security update. Affects pcs versions < 0:0.11.8-1.el9_5.2. Fixed in 0:0.11.8-1.el9_5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs package provides a command-line configuration system for managing the Pacemaker and Corosync utilities, which are essential for high-availability clustering in Linux environments. This package allows users to configure and manage cluster resources, ensuring that applications remain available even in the event of hardware or software failures. The recent vulnerability identified poses a significant risk to systems utilizing pcs, as it can lead to denial of service through HTTP cookie parsing.
Vulnerability Detail
The vulnerability, identified as CVE-2024-52804, is a denial of service (DoS) issue stemming from the python-tornado library used within the pcs package. This flaw allows an attacker to exploit the HTTP cookie parsing mechanism, potentially overwhelming the system and causing it to become unresponsive. The CVSS score for this vulnerability is 7.5, indicating a high severity level that necessitates prompt attention from system administrators.
How To Fix
Minimum fixed version
0:0.11.8-1.el9_5.2
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the use of HTTP cookies in your application until the package can be updated. This can help reduce the risk of exploitation while you prepare to apply the necessary updates.
Conclusion
The pcs package has a critical vulnerability that can lead to denial of service due to issues with HTTP cookie parsing. It is crucial to update to the patched version to protect your systems. Utilize tools like Vulert to monitor for vulnerabilities and ensure your applications remain secure.
See every vulnerability recorded for pcs →
FAQ
The pcs package is a command-line tool for configuring and managing high-availability clusters using Pacemaker and Corosync.
CVE-2024-52804 refers to a denial of service vulnerability in the python-tornado library used by the pcs package.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that requires immediate action.
If immediate updates are not possible, consider disabling HTTP cookies in your application as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
