Description
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | pcs +1 | 0.9.137-13.el7_1.4 | RHSA-2015:1700 |
| RHEL 6 | pcs | 0.9.139-9.el6_7.1 | RHSA-2015:1700 |
Advisories 1
- RHSA-2015:1700 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1252813
- RHSA-2015:1700 vendor-advisory