Skip to content
OpenAdvisories
Low RLSA-2024:5338 1 CVE

Low: pcs security update

Published May 7, 2025 · Updated May 7, 2025

Ecosystem: Rocky Linux

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 pcs 0:0.10.18-2.el8_10.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2024-35176 Public exploit

    REXML contains a denial of service vulnerability

    REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.…

    ruby rexml kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Wolfi RubyGems

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2280894