CVE-2018-1086

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter
removal bypass. REST interface of the pcsd service did not properly remove
the pcs debug argument from the /run_pcs query, possibly disclosing
sensitive information. A remote attacker with a valid token could use this
flaw to elevate their privilege.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895313&gt;