Summary
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.
Security Fix(es):
* python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields (CVE-2026-82397)
* python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVE-2024-14029)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | pcs | 0.10.18-2.el8_10.10.alma.1 |
| AlmaLinux · 8 | pcs-snmp | 0.10.18-2.el8_10.10.alma.1 |
Vulnerabilities 2
-
High 7.5
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to pe…
-
High 7.5
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in t…