Red Hat Enterprise Linux 7 update for pacemaker



Published: 2020-12-22
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-25654
CWE-ID CWE-284
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe
Red Hat Enterprise Linux Resilient Storage for x86_64
Operating systems & Components / Operating system

pacemaker (Red Hat package)
Operating systems & Components / Operating system package or component

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Improper access control

EUVDB-ID: #VU49118

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-25654

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in pacemaker. A local account on the cluster and in the haclient group can use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Resilient Storage for x86_64: 7

pacemaker (Red Hat package): before 1.1.23-1.el7_9.1


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:5453

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###