Skip to content
OpenAdvisories
Low ALSA-2024:5338 1 CVE

Low: pcs security update

Published Aug 13, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 8 pcs 0.10.18-2.el8_10.1
AlmaLinux · 8 pcs-snmp 0.10.18-2.el8_10.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2024-35176 Public exploit

    REXML contains a denial of service vulnerability

    REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.…

    ruby rexml kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Wolfi RubyGems

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-35176
  • report
    https://bugzilla.redhat.com/2280894
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-5338.html