Skip to content
OpenAdvisories
Medium ALAS2-2021-1583 1 CVE

Moderate: pacemaker security update (Amazon Linux 2)

Published Jan 5, 2021 · Updated Jan 6, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25654: An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration. 1888191: CVE-2020-25654 pacemaker: ACL restrictions bypass

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 pacemaker 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-cli 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-cluster-libs 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-cts 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-debuginfo 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-doc 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-libs 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-libs-devel 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-nagios-plugins-metadata 0:1.1.23-1.amzn2.1
Amazon Linux · 2 pacemaker-remote 0:1.1.23-1.amzn2.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-25654.html