A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade pacemakerUpgrade pacemaker-debuginfoUpgrade pacemaker-ctsUpgrade pacemaker-docUpgrade pacemaker-remoteUpgrade pacemaker-libsUpgrade pacemaker-cluster-libsUpgrade pacemaker-nagios-plugins-metadataUpgrade pacemaker-cliUpgrade pacemaker-libs-devel | Apr 27, 2020 | Apr 18, 2019 |
| Centos_linux | — | Upgrade pacemaker-nagios-plugins-metadataUpgrade pacemaker-cluster-libsUpgrade pacemaker-ctsUpgrade pacemaker-debugsourceUpgrade pacemakerUpgrade pacemaker-cliUpgrade pacemaker-cli-debuginfoUpgrade pacemaker-remote-debuginfoUpgrade pacemaker-libsUpgrade pacemaker-cluster-libs-debuginfoUpgrade pacemaker-schemasUpgrade pacemaker-libs-debuginfoUpgrade pacemaker-libs-develUpgrade pacemaker-debuginfoUpgrade pacemaker-remoteUpgrade pacemaker-doc | Aug 28, 2019 | Apr 18, 2019 |
| Debian | — | Upgrade pacemaker | Jan 8, 2021 | Apr 18, 2019 |
| Gentoo Linux | — | Upgrade sys-cluster/pacemaker. | Oct 2, 2023 | Apr 18, 2019 |
| Oracle_linux | — | Upgrade pacemaker-cluster-libsUpgrade pacemaker-libsUpgrade pacemaker-schemas | Jul 22, 2024 | Apr 17, 2019 |
| Redhat_linux | — | Upgrade pacemaker-docUpgrade pacemaker-debuginfoUpgrade pacemaker-cluster-libs-debuginfoUpgrade pacemakerUpgrade pacemaker-remoteUpgrade pacemaker-libsUpgrade pacemaker-remote-debuginfoUpgrade pacemaker-cluster-libsUpgrade pacemaker-debugsourceUpgrade pacemaker-libs-debuginfoUpgrade pacemaker-cliUpgrade pacemaker-schemasUpgrade pacemaker-ctsUpgrade pacemaker-libs-develUpgrade pacemaker-cli-debuginfoUpgrade pacemaker-nagios-plugins-metadataNo solution exists | May 28, 2019 | Apr 18, 2019 |
| Suse | — | Upgrade pacemaker-cliUpgrade libpacemaker-develUpgrade pacemaker-ctsUpgrade pacemakerUpgrade pacemaker-remoteUpgrade libpacemaker3 | Apr 27, 2019 | Apr 18, 2019 |
| Ubuntu | — | Upgrade pacemaker | Apr 30, 2019 | Apr 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub