Skip to content
OpenAdvisories
High RHSA-2018:1060 3 CVEs

Red Hat Security Advisory: pcs security update

Published Sep 18, 2024 · Updated Jul 1, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::server pcs 0:0.9.162-5.el7_5.1
Red Hat · RHEL 7 enterprise_linux:7::server pcs-debuginfo 0:0.9.162-5.el7_5.1
Red Hat · RHEL 7 enterprise_linux:7::server pcs-snmp 0:0.9.162-5.el7_5.1

Vulnerabilities 3

  • High 8.7
    CVE-2018-1079

    pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. Th…

    pcs Debian
  • Medium 5.9
    CVE-2018-1000119

    rack-protection gem timing attack vulnerability when validating CSRF token

    Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby applicat…

    rack-protection ruby-rack-protection Ubuntu RubyGems
  • Medium 4.3
    CVE-2018-1086

    pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd serv…

    Red Hat pcs pcs pcs Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1534027
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1550243
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1557366
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1060.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-1079
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1079
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1079
  • report
    https://access.redhat.com/security/cve/CVE-2018-1086
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1086
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1086
  • report
    https://access.redhat.com/security/cve/CVE-2018-1000119
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1000119
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1000119