Summary
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.
Security Fix(es):
* rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)
* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | pcs | 0.10.18-2.el8_10.5.alma.1 |
| AlmaLinux · 8 | pcs-snmp | 0.10.18-2.el8_10.5.alma.1 |
Vulnerabilities 2
-
High 7.5
Unbounded-Parameter DoS in Rack::QueryParser
Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters…
-
High 7.5
Tornado vulnerable to excessive logging caused by malformed multipart form data
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate…