Red Hat Enterprise Linux 7 update for pacemaker

Published: 2020-12-22
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-25654
Exploitation vector Local
Public exploit N/A
Vulnerable software
Red Hat Enterprise Linux Resilient Storage for x86_64
Operating systems & Components / Operating system

pacemaker (Red Hat package)
Operating systems & Components / Operating system package or component

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Improper access control

EUVDB-ID: #VU49118

Risk: Low


CVE-ID: CVE-2020-25654

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No


The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in pacemaker. A local account on the cluster and in the haclient group can use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.


Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Resilient Storage for x86_64: 7

pacemaker (Red Hat package): before 1.1.23-1.el7_9.1

CPE2.3 External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?