PT-2018-3485 · Clusterlabs+5 · Pacemaker+5

Jan Pokorný · Published 2018-11-22 · Updated 2023-09-29 · CVE-2018-16877

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Pacemaker versions up to and including 2.0.0

Description: A flaw was found in the way Pacemaker's client-server authentication was implemented, allowing a local attacker to achieve local privilege escalation by combining this flaw with other IPC weaknesses. The issue is related to insufficient authentication in the cluster resource management tool, which can be exploited to elevate privileges.

Recommendations: For Pacemaker versions up to and including 2.0.0, update to a version later than 2.0.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2019-1351

BDU:2020-02205

CESA-2019_1279

CVE-2018-16877

DLA-2519-1

MGASA-2019-0394

OPENSUSE-SU-2019:1400-1

OPENSUSE-SU-2019_1342-1

OPENSUSE-SU-2019_1400-1

OPENSUSE-SU-2024:11138-1

RHSA-2019:1278

RHSA-2019:1279

RHSA-2019_1278

RHSA-2019_1279

SUSE-SU-2019:1047-1

SUSE-SU-2019:1108-1

SUSE-SU-2019:1209-1

SUSE-SU-2019:2268-1

SUSE-SU-2019_1047-1

SUSE-SU-2019_1108-1

SUSE-SU-2019_1209-1

SUSE-SU-2019_2268-1

SUSE-SU-2020:1072-1

SUSE-SU-2020_1072-1

USN-3952-1

Affected Products

Alt Linux

Centos

Pacemaker

Red Hat

Suse

Ubuntu

References · 73

• https://github.com/ClusterLabs/pacemaker/pull/1749 · Patch
• https://osv.dev/vulnerability/DLA-2519-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16877 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0394 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1047-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16877 · Patch
• https://ubuntu.com/security/CVE-2018-16878 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3885 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0394.html · Security Note
• https://linux.oracle.com/errata/ELSA-2019-1279.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-3952-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16877 · Vendor Advisory
• https://usn.ubuntu.com/3952-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1278 · Vendor Advisory