CVE-2015-5189

2015-09-0314:59:02

Debian Security Bug Tracker

security-tracker.debian.org

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

45.9%

JSON

Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.

OSVersionArchitecturePackageVersionFilename
Debian12allpcs< 0.11.5-1+deb12u1pcs_0.11.5-1+deb12u1_all.deb
Debian11allpcs< 0.10.8-1+deb11u1pcs_0.10.8-1+deb11u1_all.deb
Debian999allpcs< 0.11.7-1pcs_0.11.7-1_all.deb
Debian13allpcs< 0.11.7-1pcs_0.11.7-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	pcs	< 0.11.5-1+deb12u1	pcs_0.11.5-1+deb12u1_all.deb
Debian	11	all	pcs	< 0.10.8-1+deb11u1	pcs_0.10.8-1+deb11u1_all.deb
Debian	999	all	pcs	< 0.11.7-1	pcs_0.11.7-1_all.deb
Debian	13	all	pcs	< 0.11.7-1	pcs_0.11.7-1_all.deb