Skip to content
OpenAdvisories
Medium ELSA-2024-2113 3 CVEs

Moderate: pcs security update (Oracle Linux 9)

Published May 2, 2024 · Updated May 2, 2024

Ecosystem: Oracle Linux

Summary

[0.11.7-2]
- Fixed CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 in bundled dependency rack
Resolves: RHEL-26446, RHEL-26448, RHEL-26450

[0.11.7-1]
- Rebased to the latest sources (see CHANGELOG.md)
Resolves: RHEL-7740

[0.11.6-6]
- Rebased to the latest upstream sources (see CHANGELOG.md)
Resolves: RHEL-7582, RHEL-7583, RHEL-7669, RHEL-7672, RHEL-7697, RHEL-7698, RHEL-7700, RHEL-7703, RHEL-7719, RHEL-7725, RHEL-7730, RHEL-7738, RHEL-7739, RHEL-7740, RHEL-7744, RHEL-7746
- TLS cipher setting in pcsd now follows system-wide crypto policies by default
Resolves: RHEL-7724
- Tightened permissions of bundled rubygems to be 755 or stricter
Resolves: RHEL-7716

[0.11.6-5]
- No changes, fixing an error in a new quality control process
- Resolves: RHEL-15217

[0.11.6-4]
- No changes, testing a new quality control process
- Resolves: RHEL-15217

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 9 pcs 0:0.11.7-2.el9_4
Oracle Linux · 9 pcs-snmp 0:0.11.7-2.el9_4

Vulnerabilities 3

  • Medium 5.8
    CVE-2024-26141

    Possible DoS Vulnerability with Range Header in Rack

    Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the …

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems
  • Medium 5.3
    CVE-2024-25126 EPSS 35%

    Rack ReDos in content type parsing (2nd degree polynomial)

    Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability i…

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems
  • Medium 5.3
    CVE-2024-26146

    Possible Denial of Service Vulnerability in Rack Header Parsing

    Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this …

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems