CVE-2022-2735

A vulnerability was found in the PCS project. This issue occurs due to
incorrect permissions on a Unix socket used for internal communication
between PCS daemons. A privilege escalation could happen by obtaining an
authentication token for a hacluster user. With the “hacluster” token, this
flaw allows an attacker to have complete control over the cluster managed
by PCS.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1018930&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=2116815&gt;

Notes