Summary
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.
Security Fix(es):
* webpack: avoid cross-realm objects (CVE-2023-28154)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | pcs | 0.11.3-4.el9_1.3 |
| AlmaLinux · 9 | pcs-snmp | 0.11.3-4.el9_1.3 |
Vulnerabilities 1
-
Critical 9.8
Cross-realm object access in Webpack 5
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.