Description
Session fixation vulnerability in pcsd in pcs before 0.9.157.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pcs | 0.9.149-1 | — |
| Debian 13 | pcs | 0.9.149-1 | — |
| Debian 12 | pcs | 0.9.149-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | pcs | 0.9.152-10.el7 | RHSA-2016:2596 |
Advisories 1
- RHSA-2016:2596 Red Hat Security Advisory: pcs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · May 13, 2026
References
- https://github.com/ClusterLabs/pcs/commit/bc6ad9086857559db57f4e3e6de66762291c0774
- https://bugzilla.redhat.com/show_bug.cgi?id=1299615
- https://github.com/ClusterLabs/pcs/commit/e9b28833d54a47ec441f6dbad0db96e1fc662a5b
- FEDORA-2016-cdd4228cc7 vendor-advisory
- 97977 vdb-entry
- RHSA-2016:2596 vendor-advisory
- https://github.com/ClusterLabs/pcs/commit/acdbbe8307e6f4a36b2c7754765e732e43fe8d17
- FEDORA-2016-3b20c4ec9d vendor-advisory