Description
tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux (RHEL) 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tog-pegasus +1 | 2:2.7.0-2.el5_2.1 | RHSA-2008:1001 |
Advisories 1
- RHSA-2008:1001 Red Hat Security Advisory: tog-pegasus security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=472017
- https://admin.fedoraproject.org/updates/tog-pegasus-2.7.0-7.fc9
- 1021281 vdb-entry
- 50278 vdb-entry
- RHSA-2008:1001 vendor-advisory
- oval:org.mitre.oval:def:9431 vdb-entry signature
- https://admin.fedoraproject.org/updates/tog-pegasus-2.7.1-3.fc10
- togpegasus-systemlog-weak-security(46830) vdb-entry
- 32862 third-party-advisory