What is CVE-2018-16877?

CVE-2018-16877 is a high-severity vulnerability in Clusterlabs Pacemaker, classified under Improper Authentication. CVSS score: 7.8/10. Published 2019-04-18.

How severe is CVE-2018-16877?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2018-16877 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Clusterlabs Pacemaker

CVE-2018-16877

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalati…

Vulnerability class: Broken Authentication

EPSS: 0.004 (32.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Clusterlabs Pacemaker — versions affects up to and including Pacemaker-2.0.0
Canonical Ubuntu_linux — versions 16.04, 18.04, 18.10
Debian Debian_linux — versions 9.0
Fedoraproject Fedora — versions 28, 29, 30
Opensuse Leap — versions 15.0, 42.3
Redhat Enterprise_linux — versions 8.0
Redhat Enterprise_linux_eus — versions 8.1, 8.2, 8.4
Redhat Enterprise_linux_server_aus — versions 8.2, 8.4, 8.6
Redhat Enterprise_linux_server_tus — versions 8.2, 8.4, 8.6

Weakness classification (CWE)

CWE-287 — Improper Authentication

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

secalert@redhat.com (Patch, Third Party Advisory, Issue Tracking)
secalert@redhat.com (Patch, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory)
secalert@redhat.com (vdb-entry, Broken Link)
secalert@redhat.com (vendor-advisory)
secalert@redhat.com (vendor-advisory)
secalert@redhat.com (vendor-advisory)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2018-16877?: CVE-2018-16877 is a high-severity vulnerability in Clusterlabs Pacemaker, classified under Improper Authentication. CVSS score: 7.8/10. Published 2019-04-18.
How severe is CVE-2018-16877?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2018-16877 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.