Red Hat Security AdvisoryRHSA-2015:1700
pcs security update
Released 2015-09-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux High Availability (v. 6) pcs-0.9.139-9.el6_7.1
- Red Hat Enterprise Linux Resilient Storage (v. 6) pcs-0.9.139-9.el6_7.1
- Red Hat Enterprise Linux Server High Availability (v. 7) pcs-0.9.137-13.el7_1.4, python-clufter-0.9.137-13.el7_1.4
- Red Hat Enterprise Linux Server Resilient Storage (v. 7) pcs-0.9.137-13.el7_1.4, python-clufter-0.9.137-13.el7_1.4
Fixes 2 records
Priority MEDIUM 42
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
CVSS 2.0HIGH 8.5· Network · Low privileges · Interaction — · EPSS 0.02544 · Published 2015-09-03 · Fixed CWE-77
Priority LOW 24
Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another u…
CVSS 2.0MEDIUM 4.9· Network · Low privileges · Interaction — · EPSS 0.0098 · Published 2015-09-03 · Fixed CWE-362
