Skip to content
OpenAdvisories
High USN-6711-1 1 CVE

crmsh vulnerability

Published Mar 25, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Vincent Berg discovered that CRM shell incorrectly handled certain commands.
An local attacker could possibly use this issue to execute arbitrary code
via shell code injection to the crm history commandline.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS crmsh 4.2.0-2ubuntu1.1

Vulnerabilities 1

  • High 7.8
    CVE-2020-35459

    ClusterLabs crmsh vulnerable to shell code injection

    An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.

    crmsh crmsh crmsh Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-35459