ALT-PU-2022-5299-1

Package update pcs in branch sisyphus_mipsel

Version0.11.3-alt1

Task#0

Published2022-06-27

Max severityHIGH

Severity:

Closed issues (2)

HIGH8.8

Уязвимость утилиты для настройки программ corosync/pacemaker PCS, связанная с недостатками процедуры аутентификации, позволяющая нарушителю повысить свои привилегии

Published: 2022-09-07Modified: 2025-03-05

CVSS 3.xHIGH 8.8

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 9.0

CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C

References

CVE-2022-1049

HIGH8.8

A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.

Published: 2022-03-25Modified: 2024-11-21

CVSS 2.0MEDIUM 6.5

CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS 3.xHIGH 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References