A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade pacemaker-cliUpgrade pacemaker-nagios-plugins-metadataUpgrade pacemaker-libs-develUpgrade pacemaker-remoteUpgrade pacemaker-cluster-libsUpgrade pacemaker-libsUpgrade pacemaker-docUpgrade pacemakerUpgrade pacemaker-ctsUpgrade pacemaker-debuginfo | Apr 27, 2020 | Apr 18, 2019 |
| Centos_linux | — | Upgrade pacemaker-debugsourceUpgrade pacemaker-ctsUpgrade pacemaker-cluster-libsUpgrade pacemaker-nagios-plugins-metadataUpgrade pacemakerUpgrade pacemaker-cli-debuginfoUpgrade pacemaker-schemasUpgrade pacemaker-libsUpgrade pacemaker-debuginfoUpgrade pacemaker-remote-debuginfoUpgrade pacemaker-libs-develUpgrade pacemaker-cluster-libs-debuginfoUpgrade pacemaker-remoteUpgrade pacemaker-docUpgrade pacemaker-libs-debuginfoUpgrade pacemaker-cli | Aug 28, 2019 | Apr 18, 2019 |
| Debian | — | Upgrade pacemaker | Jan 8, 2021 | Apr 18, 2019 |
| Gentoo Linux | — | Upgrade sys-cluster/pacemaker. | Oct 2, 2023 | Apr 18, 2019 |
| Oracle_linux | — | Upgrade pacemaker-cluster-libsUpgrade pacemaker-libsUpgrade pacemaker-schemas | Jul 22, 2024 | Apr 17, 2019 |
| Redhat_linux | — | Upgrade pacemaker-remote-debuginfoUpgrade pacemaker-cliUpgrade pacemaker-libs-debuginfoUpgrade pacemaker-cluster-libsUpgrade pacemaker-remoteUpgrade pacemaker-docUpgrade pacemaker-libsUpgrade pacemaker-cluster-libs-debuginfoUpgrade pacemakerUpgrade pacemaker-debugsourceUpgrade pacemaker-debuginfoUpgrade pacemaker-schemasUpgrade pacemaker-nagios-plugins-metadataUpgrade pacemaker-libs-develUpgrade pacemaker-cli-debuginfoNo solution existsUpgrade pacemaker-cts | May 28, 2019 | Apr 18, 2019 |
| Suse | — | Upgrade pacemakerUpgrade libpacemaker3Upgrade pacemaker-remoteUpgrade pacemaker-ctsUpgrade pacemaker-cliUpgrade libpacemaker-devel | Apr 27, 2019 | Apr 18, 2019 |
| Ubuntu | — | Upgrade pacemaker | Apr 30, 2019 | Apr 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub