Skip to content
OpenAdvisories
High RLSA-2023:1591 1 CVE

Important: pcs security update

Published Apr 6, 2023 · Updated Feb 4, 2026

Ecosystem: Rocky Linux

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* webpack: avoid cross-realm objects (CVE-2023-28154)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 pcs 0:0.11.3-4.el9_1.3

Vulnerabilities 1

  • Critical 9.8
    CVE-2023-28154

    Cross-realm object access in Webpack 5

    Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

    node-webpack webpack node-webpack Debian Ubuntu npm

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2179227