Debian DSA-4791-1 : pacemaker - security update

Ken Gaillot discovered a vulnerability in the Pacemaker cluster resource manager: If ACLs were configured for users in the 'haclient'group, the ACL restrictions could be bypassed via unrestricted IPC communication, resulting in cluster-wide arbitrary code execution with root privileges. If the...

Authorization Bypass

pacemaker is vulnerable to authorization bypass. The vulnerability exists through an ACL bypass flaw, where users can use IPC communication with the various daemons directly to bypass ACL restrictions...

[SECURITY] [DSA 4791-1] pacemaker security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4791-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 13, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DLA 2447-1] pacemaker security update

Debian LTS Advisory DLA-2447-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 11, 2020 https://wiki.debian.org/LTS Package : pacemaker Version : 1.1.16-1+deb9u1 CVE ID : CVE-2020-25654 Debian Bug : 973254 An ACL bypass flaw was found in pacemaker, a...

Debian: Security Advisory (DLA-2447-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-OU-2020:3291-1 Optional update for python-redis and redis

This optional update for python-redis and redis provides the following fixes python-redis: - Update to version to 3.4.1 jscECO-2417 Move the username argument in the Redis and Connection classes to the end of the argument list. This helps those poor souls that specify all their connection options...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Pacemaker vulnerability (USN-4623-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4623-1 advisory. Ken Gaillot discovered that Pacemaker incorrectly handled IPC communications permissions. A local attacker could possibly use this issue t...

Updated pacemaker packages fix a security vulnerability

ACL restrictions bypass. CVE-2020-25654...

MGASA-2020-0409 Updated pacemaker packages fix a security vulnerability

ACL restrictions bypass. CVE-2020-25654...

USN-4623-1: Pacemaker vulnerability

Ken Gaillot discovered that Pacemaker incorrectly handled IPC communications permissions. A local attacker could possibly use this issue to bypass ACL restrictions and execute arbitrary code as root...

Privilege Escalation

cyrus-imapd is vulnerable to privilege escalation. It is possible in component created mailboxes with administrator privileges if the "fileinto" was used, bypassing ACL checks...

Moderate: cyrus-imapd security update

The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support. Security Fixes: cyrus-imapd: privilege escalation in HTTP request CVE-2019-18928 cyrus-imapd: lmtpd component created mailboxes with administrator privileges if the "fileinto" was used,...

EulerOS 2.0 SP5 : kernel (EulerOS-SA-2020-2303)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have...

CVE-2020-25654

An ACL bypass flaw was found in Pacemaker. This flaw allows an attacker with a local account on the cluster and in the haclient group to use IPC communication with various daemons to directly perform certain tasks that would be prevented if they had gone through configured ACLs. The highest threa...

CVE-2020-25654

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration...

[20210307] - Core - ACL violation within com_content frontend editing

Incorrect ACL checks could allow unauthorized change of the category for an article...

Chocolatey Boxstarter is vulnerable to privilege escalation due to weak ACLs

Overview Chocolatey Boxstarter fails to properly set ACLs, which can allow an unprivileged Windows user to be able to run arbitrary code with SYSTEM privileges. Description CVE-2020-15264 The Chocolatey Boxstarter installer fails to set a secure access-control list ACL on the...

CVE-2020-10140

Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths...

Code injection

Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths...

CVE-2020-10140

CVE-2020-10140 affects Acronis True Image 2021, where ACLs for C:\ProgramData\Acronis are not set correctly. This allows an unprivileged user to achieve arbitrary code execution with SYSTEM privileges by placing a DLL in several paths under C:\ProgramData\Acronis, because some privileged processe...