Skip to content
OpenAdvisories
High ELSA-2018-1060 3 CVEs

Important: pcs security update (Oracle Linux 7)

Published Apr 30, 2018 · Updated Apr 30, 2018

Ecosystem: Oracle Linux

Summary

[0.9.162-5.0.3.el7_5.1]
- Unlike RHEL we DO have corosync/pacemaker for aarch64 on EL7
- replace logo pcsd/public/favicon.ico in tarball
- remove Source1 HAM-logo.png

[0.9.162-5.el7_5.1]
- Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
- Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
- Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
- Resolves: rhbz#1557253

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 7 pcs 0:0.9.162-5.0.3.el7_5.1
Oracle Linux · 7 pcs-snmp 0:0.9.162-5.0.3.el7_5.1

Vulnerabilities 3

  • High 8.7
    CVE-2018-1079

    pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. Th…

    pcs Debian
  • Medium 5.9
    CVE-2018-1000119

    rack-protection gem timing attack vulnerability when validating CSRF token

    Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby applicat…

    rack-protection ruby-rack-protection Ubuntu RubyGems
  • Medium 4.3
    CVE-2018-1086

    pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd serv…

    Red Hat pcs pcs pcs Debian Ubuntu