pcs security update

2018-05-3018:24:25

CentOS Project

lists.centos.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

77.8%

JSON

CentOS Errata and Security Advisory CESA-2018:1060

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

pcs: Privilege escalation via authorized user malicious REST call (CVE-2018-1079)
pcs: Debug parameter removal bypass, allowing information disclosure (CVE-2018-1086)
rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The CVE-2018-1079 issue was discovered by Ondrej Mular (Red Hat) and the CVE-2018-1086 issue was discovered by Cedric Buissart (Red Hat).

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2018-May/085055.html

Affected packages:
pcs
pcs-snmp

Upstream details at:
https://access.redhat.com/errata/RHSA-2018:1060

OSVersionArchitecturePackageVersionFilename
CentOS7x86_64pcs< 0.9.162-5.el7.centos.1pcs-0.9.162-5.el7.centos.1.x86_64.rpm
CentOS7x86_64pcs-snmp< 0.9.162-5.el7.centos.1pcs-snmp-0.9.162-5.el7.centos.1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	7	x86_64	pcs	< 0.9.162-5.el7.centos.1	pcs-0.9.162-5.el7.centos.1.x86_64.rpm
CentOS	7	x86_64	pcs-snmp	< 0.9.162-5.el7.centos.1	pcs-snmp-0.9.162-5.el7.centos.1.x86_64.rpm