Description
A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | clusterlabs/pcs | pcs versions <= v0.11.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pcs | 0.11.3-1 | — |
| Debian 13 | pcs | 0.11.3-1 | — |
| Debian 12 | pcs | 0.11.3-1 | — |
| Debian 11 | pcs | 0.10.8-1+deb11u1 | DSA-5226-1 |
| Debian 10 | pcs | 0.10.1-2+deb10u1 | DLA-3108-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | pcs | 0.10.11-2ubuntu3+esm1 | USN-7614-1 |
| Ubuntu Pro 20.04 LTS | pcs | 0.10.4-3ubuntu0.1~esm1 | USN-7614-1 |
| Ubuntu Pro 16.04 LTS | pcs | 0.9.149-1ubuntu1.1+esm1 | USN-7614-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | pcs +1 | 0.11.3-4.el9 | RHSA-2022:7935 |
| RHEL 8 | pcs +1 | 0.10.14-5.el8 | RHSA-2022:7447 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | pcs +1 | 0.11.3-4.el9 | ALSA-2022:7935 |
| AlmaLinux 8 | pcs +1 | 0.10.14-5.el8.alma | ALSA-2022:7447 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pcs | 0.11.3-4.el9_1.1 | RLSA-2022:7935 |
| Rocky Linux 8 | pcs | 0.10.14-5.el8 | RLSA-2022:7447 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | pcs +1 | 0.11.3-4.el9 | ELSA-2022-10007 |
| Oracle Linux 8 | pcs +1 | 0.10.14-5.0.1.el8 | ELSA-2022-10031 |
Advisories 12
- ALSA-2022:7935 Moderate: pcs security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:7447 Moderate: pcs security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:7935 Red Hat Security Advisory: pcs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:7447 Red Hat Security Advisory: pcs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-7614-1 pcs vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2022-2044 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 9, 2026
- DSA-5226-1 pcs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3108-1 pcs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:7935 Moderate: pcs security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2022:7447 Moderate: pcs security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- ELSA-2022-10031 Moderate: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 29, 2022
- ELSA-2022-10007 Moderate: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 22, 2022