Skip to content
OpenAdvisories
High ELSA-2025-8254 2 CVEs

Important: pcs security update (Oracle Linux 8)

Published May 28, 2025 · Updated May 28, 2025

Ecosystem: Oracle Linux

Summary

[0.10.18-2.0.1.el8_10.5]
- Replace HAM-logo.png with a generic one

[0.10.18-2.el8_10.5]
- Fixed CVE-2024-52804 by patching bundled Tornado
Resolves: RHEL-93167
- Fixed CVE-2025-46727 by updating bundled rubygem rack
Resolves: RHEL-90147

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 pcs 0:0.10.18-2.0.1.el8_10.5
Oracle Linux · 8 pcs-snmp 0:0.10.18-2.0.1.el8_10.5

Vulnerabilities 2

  • High 7.5
    CVE-2025-46727

    Unbounded-Parameter DoS in Rack::QueryParser

    Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-47287

    Tornado vulnerable to excessive logging caused by malformed multipart form data

    Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate…

    tornadoweb tornado airflow-3 kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Wolfi PyPI