PT-2019-5045 · Red Hat+2 · Fence-Agents+3

Doran Moppert · Published 2019-07-10 · Updated 2024-06-15 · CVE-2019-10153

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions fence-agents versions prior to 4.3.4

Description A flaw in fence-agents can cause the fence rhevm component to exit with an exception when non-ASCII characters are used in certain fields of a guest VM, such as comments. This issue can lead to denial of service in cluster environments, preventing automated recovery. The vulnerability is related to encoding errors and can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 4.3.4, update to version 4.3.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of non-ASCII characters in guest VM comments and other fields to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-172

Related Identifiers

BDU:2020-01687

CESA-2019_2037

CVE-2019-10153

MGASA-2019-0398

OPENSUSE-SU-2019:1719-1

OPENSUSE-SU-2019:1751-1

OPENSUSE-SU-2019_1719-1

OPENSUSE-SU-2019_1751-1

OPENSUSE-SU-2024:10752-1

RHSA-2019:2037

RHSA-2019_2037

SUSE-SU-2019:1809-1

SUSE-SU-2019:1813-1

SUSE-SU-2019:1819-1

SUSE-SU-2019_1809-1

SUSE-SU-2019_1813-1

SUSE-SU-2019_1819-1

Affected Products

Centos

Red Hat

Suse

Fence-Agents

References · 31

• https://github.com/ClusterLabs/fence-agents/pull/272 · Patch
• https://github.com/ClusterLabs/fence-agents/pull/255 · Patch
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10153 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1819-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01687 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10153 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0398 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1813-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1719-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10153 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1751-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10153 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1809-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0398.html · Security Note