CVE-2024-3049 | Medium | 5.9 | 2024-06-06 | A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accep… |
CVE-2023-39976 | Critical | 9.8 | 2023-08-08 | log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. |
CVE-2023-2319 | Critical | 9.8 | 2023-05-17 | It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the W… |
CVE-2022-2735 | High | 7.8 | 2022-09-06 | A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemo… |
CVE-2021-3020 | High | 8.8 | 2022-08-26 | An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended t… |
CVE-2022-2553 | Medium | 6.5 | 2022-07-28 | The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do no… |
CVE-2022-1049 | High | 8.8 | 2022-03-25 | A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when usi… |
CVE-2010-2496 | Medium | 5.5 | 2021-10-18 | stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the… |
CVE-2020-35459 | High | 7.8 | 2021-01-12 | An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via sh… |
CVE-2020-35458 | Critical | 9.8 | 2021-01-12 | An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_… |
CVE-2020-25654 | High | 7.2 | 2020-11-24 | An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various… |
CVE-2014-0104 | Medium | 5.9 | 2020-01-02 | In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attack… |
CVE-2011-5271 | Medium | 5.5 | 2019-11-12 | Pacemaker before 1.1.6 configure script creates temporary files insecurely |
CVE-2019-10153 | Medium | 5.0 | 2019-07-30 | A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm… |
CVE-2019-12779 | High | 7.1 | 2019-06-07 | libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) withou… |
CVE-2019-3885 | Low | 3.3 | 2019-04-18 | A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system… |
CVE-2018-16878 | Medium | 5.5 | 2019-04-18 | A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS |
CVE-2018-16877 | High | 7.8 | 2019-04-18 | A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this fla… |
CVE-2016-7035 | High | 8.8 | 2018-09-10 | An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pa… |
CVE-2018-1079 | High | 8.7 | 2018-04-12 | pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did… |
CVE-2018-1086 | Medium | 4.3 | 2018-04-12 | pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debu… |
CVE-2017-2661 | Medium | 6.1 | 2018-03-12 | ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cl… |
CVE-2016-0721 | High | 8.1 | 2017-04-21 | Session fixation vulnerability in pcsd in pcs before 0.9.157. |
CVE-2016-0720 | High | 8.8 | 2017-04-21 | Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149. |
CVE-2016-7797 | High | 7.5 | 2017-03-24 | Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated con… |
CVE-2015-1867 | | | 2015-08-12 | Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command. |
CVE-2013-0281 | | | 2013-11-23 | Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the… |