Information disclosure in pcs (Debian package) - CVE-2018-1086

Vulnerability identifier: #VU11772

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1086

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the REST interface due to debug parameter removal bypass. A remote attacker can gain access to potentially sensitive information.

pcs (Debian package)
pcs (Ubuntu package)
pcs
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power
Ubuntu
Fedora

Update to version 0.9.155+dfsg-2+deb9u1.

pcs (Ubuntu package) - addressed in versions 0.9.149-1ubuntu1.1+esm1, 0.10.4-3ubuntu0.1~esm1, 0.10.11-2ubuntu3+esm1
pcs - addressed in versions 0.9.160-2.fc26, 0.9.164-1.fc27, 0.9.164-1.fc28

• https://security-tracker.debian.org/tracker/CVE-2018-1086

• Debian update for pcs
• Red Hat update for pcs
• Red Hat update for pcs
• Fedora 27 update for pcs
• Fedora 28 update for pcs
• Fedora 26 update for pcs
• Ubuntu update for pcs