Description
Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | pcs +1 | 0.9.137-13.el7_1.4 | RHSA-2015:1700 |
| RHEL 6 | pcs | 0.9.139-9.el6_7.1 | RHSA-2015:1700 |
Advisories 1
- RHSA-2015:1700 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1252805
- RHSA-2015:1700 vendor-advisory