Authentication flaw

A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal t...

Design/Logic Flaw

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the...

CVE-2020-25660

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the...

CVE-2020-25660

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the...

CVE-2020-25688

A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal t...

GaussDB Kernel: Prohibiting host Entries (Except Intra-Cluster Nodes) from Using Trust Authentication in the pg_hba.conf File

Cluster nodes are deployed on the secure intranet. Only the communications between intra-cluster nodes are allowed to use trust authentication. Trust authentication assumes that all users who can connect to the cluster server nodes can access the database. This method is applied only when all use...

GaussDB Kernel: Configuring the Validity Period of User Roles

During role creation, the keyword VALID BEGIN is used to set the role validity start time and VALID UNTIL to set the end time. If these two keywords are not set, roles are permanently valid. The role expiration time on each node in the GaussDB Kernel cluster depends on the OS clock on each node...

GaussDB Kernel: Configuring Node Connections in the pg_hba.conf File of DNs in the Cluster

Cluster nodes are deployed on the secure intranet. A DN allows communications only within the cluster. The pghba.conf file of a DN stores only configurations of intra-cluster node connections and trusted internal security connections. Copyright C 2020 Greenbone Networks GmbH Some text description...

CentOS: Security Advisory for fence-agents-aliyun (CESA-2020:5003)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

fence security update

CentOS Errata and Security Advisory CESA-2020:5003 An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Debian DLA-2447-2 : pacemaker regression update

The update of pacemaker released as DLA-2447-1 caused a regression when the communication between the Corosync cluster engine and pacemaker takes place. A permission problem prevents IPC requests between cluster nodes. The patch for CVE-2020-25654 has been reverted until a better solution can be...

Low: Red Hat Bug Fix Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.0.5 images

Red Hat Advanced Cluster Management for Kubernetes 2.0.5 General Availability release. Red Hat Advanced Cluster Management for Kubernetes 2.0.5 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability...

Low: Red Hat Security Advisory: fence-agents security and bug fix update

An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

November 10, 2020—KB4586805 (Security-only update)

None None...

November 10, 2020—KB4586827 (Monthly Rollup)

None None...

Vulnerability of the Cluster component: The JS module (Node.js) of the Oracle MySQL Cluster database management system, which allows a hacker to execute arbitrary code.

Vulnerability of the Cluster component: The JS module Node.js of the Oracle MySQL Cluster database management system is vulnerable due to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2020-25655

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permissio...

CVE-2020-25655

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permissio...

USN-4623-1: Pacemaker vulnerability

Ken Gaillot discovered that Pacemaker incorrectly handled IPC communications permissions. A local attacker could possibly use this issue to bypass ACL restrictions and execute arbitrary code as root...

MGASA-2020-0400 Updated webmin package fixes security vulnerabilities

An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed. CVE-2020-8820 An...