Description
Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | pacemaker +8 | 1.1.13-10.el7 | RHSA-2015:2383 |
| RHEL 6 | pacemaker +7 | 1.1.12-8.el6 | RHSA-2015:1424 |
Advisories 2
- RHSA-2015:2383 Red Hat Security Advisory: pacemaker security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2015:1424 Red Hat Security Advisory: pacemaker security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- FEDORA-2015-f9864ecd8f vendor-advisory
- RHSA-2015:1424 vendor-advisory
- https://github.com/ClusterLabs/pacemaker/commit/84ac07c
- FEDORA-2015-e5e36bbb87 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1211370
- GLSA-201710-08 vendor-advisory
- 74231 vdb-entry
- RHSA-2015:2383 vendor-advisory
- FEDORA-2015-f6860d8f9d vendor-advisory