An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

The remote host is affected by the vulnerability described in GLSA-202309-09 (Pacemaker: Multiple Vulnerabilities)

  - A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and     including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to     achieve local privilege escalation. (CVE-2018-16877)

  - A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted     preference of uncontrolled processes can lead to DoS (CVE-2018-16878)

  - A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in     certain sensitive information to be leaked via the system logs. (CVE-2019-3885)

  - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the     haclient group could use IPC communication with various daemons directly to perform certain tasks that     they would be prevented by ACLs from doing if they went through the configuration. (CVE-2020-25654)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5453 advisory.

  - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the     haclient group could use IPC communication with various daemons directly to perform certain tasks that     they would be prevented by ACLs from doing if they went through the configuration. (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:5487 advisory.

  - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the     haclient group could use IPC communication with various daemons directly to perform certain tasks that     they would be prevented by ACLs from doing if they went through the configuration. (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pacemaker packages installed that are affected by a vulnerability:

  - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the     haclient group could use IPC communication with various daemons directly to perform certain tasks that     they would be prevented by ACLs from doing if they went through the configuration. (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pacemaker packages installed that are affected by a vulnerability:

  - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the     haclient group could use IPC communication with various daemons directly to perform certain tasks that     they would be prevented by ACLs from doing if they went through the configuration. (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:5487 advisory.

  - pacemaker: ACL restrictions bypass (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:5453 advisory.

  - pacemaker: ACL restrictions bypass (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several security vulnerabilities were addressed in pacemaker, a cluster resource manager.

CVE-2018-16877

A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

CVE-2018-16878

An insufficient verification inflicted preference of uncontrolled processes can lead to denial of service.

CVE-2020-25654

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

For Debian 9 stretch, these problems have been fixed in version 1.1.24-0+deb9u1.

We recommend that you upgrade your pacemaker packages.

For the detailed security status of pacemaker please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/pacemaker

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1583 advisory.

  - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the     haclient group could use IPC communication with various daemons directly to perform certain tasks that     they would be prevented by ACLs from doing if they went through the configuration. (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5487 advisory.

  - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the     haclient group could use IPC communication with various daemons directly to perform certain tasks that     they would be prevented by ACLs from doing if they went through the configuration. (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5453 advisory.

  - pacemaker: ACL restrictions bypass (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5487 advisory.

  - pacemaker: ACL restrictions bypass (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2020:5453-1 advisory.

  - pacemaker: ACL restrictions bypass (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5423 advisory.

  - pacemaker: ACL restrictions bypass (CVE-2020-25654)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

** Wed Nov 18 2020 Klaus Wenninger <kwenning@redhat.com> - 2.0.5-0.7.rc3 **

  - a little more syncing with upstream spec-file

** Tue Nov 17 2020 Klaus Wenninger <kwenning@redhat.com> - 2.0.5-0.6.rc3 **

  - Update for new upstream tarball for release candidate:
    Pacemaker-2.0.5-rc3 for full details, see included     ChangeLog file or     https://github.com/ClusterLabs/pacemaker/releases/tag/Pa     cemaker-2.0.5-rc3

  - Corosync in Fedora now provides corosync-devel as well     in isa-flavor

** Sun Nov 1 2020 Klaus Wenninger <kwenning@redhat.com> - 2.0.5-0.5.rc2 **

  - Update for new upstream tarball for release candidate:
    Pacemaker-2.0.5-rc2, includes fix for CVE-2020-25654 for     full details, see included ChangeLog file or     https://github.com/ClusterLabs/pacemaker/releases/tag/Pa     cemaker-2.0.5-rc2

  - Remove dependencies to nagios-plugins from     metadata-package

  - some sync with structure of upstream spec-file

  - removed some legacy conditionals

  - added with-cibsecrets

  - enable some basic gating-tests

  - remove building documentation using publican from ELN

  - rename doc-dir for ELN

----

  - Update for new upstream tarball for release candidate:
    Pacemaker-2.0.5-rc2, includes fix for CVE-2020-25654 for     full details, see included ChangeLog file or     https://github.com/ClusterLabs/pacemaker/releases/tag/Pa     cemaker-2.0.5-rc2

  - Remove dependencies to nagios-plugins from     metadata-package

  - some sync with structure of upstream spec-file

  - removed some legacy conditionals

  - added with-cibsecrets

  - enable some basic gating-tests

  - remove building documentation using publican from ELN

  - rename doc-dir for ELN

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Nov 18 2020 Klaus Wenninger <kwenning@redhat.com> -     2.0.5-0.7.rc3

  - a little more syncing with upstream spec-file

  - Tue Nov 17 2020 Klaus Wenninger <kwenning@redhat.com> -     2.0.5-0.6.rc3

  - Update for new upstream tarball for release candidate:
    Pacemaker-2.0.5-rc3 for full details, see included     ChangeLog file or     https://github.com/ClusterLabs/pacemaker/releases/tag/Pa     cemaker-2.0.5-rc3

  - Corosync in Fedora now provides corosync-devel as well     in isa-flavor

  - Sun Nov 1 2020 Klaus Wenninger <kwenning@redhat.com> -     2.0.5-0.5.rc2

  - Update for new upstream tarball for release candidate:
    Pacemaker-2.0.5-rc2, includes fix for CVE-2020-25654 for     full details, see included ChangeLog file or     https://github.com/ClusterLabs/pacemaker/releases/tag/Pa     cemaker-2.0.5-rc2

  - Remove dependencies to nagios-plugins from     metadata-package

  - some sync with structure of upstream spec-file

  - removed some legacy conditionals

  - added with-cibsecrets

  - enable some basic gating-tests

  - remove building documentation using publican from ELN

  - rename doc-dir for ELN

----

  - Update for new upstream tarball for release candidate:
    Pacemaker-2.0.5-rc2, includes fix for CVE-2020-25654 for     full details, see included ChangeLog file or     https://github.com/ClusterLabs/pacemaker/releases/tag/Pa     cemaker-2.0.5-rc2

  - Remove dependencies to nagios-plugins from     metadata-package

  - some sync with structure of upstream spec-file

  - removed some legacy conditionals

  - added with-cibsecrets

  - enable some basic gating-tests

  - remove building documentation using publican from ELN

  - rename doc-dir for ELN

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ken Gaillot discovered a vulnerability in the Pacemaker cluster resource manager: If ACLs were configured for users in the 'haclient'group, the ACL restrictions could be bypassed via unrestricted IPC communication, resulting in cluster-wide arbitrary code execution with root privileges.

If the 'enable-acl' cluster option isn't enabled, members of the'haclient' group can modify Pacemaker's Cluster Information Base without restriction, which already gives them these capabilities, so there is no additional exposure in such a setup.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4623-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for pacemaker fixes the following issues :

  - executor: restrict certain IPC requests to Pacemaker     daemons (CVE-2020-25654, bsc#1177916)

  - extra: add vim modelines to agents

  - extra: quote shell variables in agent code where     appropriate (bsc#1175557)

  - extra: remove trailing whitespace from agent code

  - extra: update agent boilerplate (copyright/license     notices)

  - extra: use 4-space indents in resource agent code

  - extra: use ':=' where appropriate in agent code

  - fencer: restrict certain IPC requests to privileged     users (CVE-2020-25654, bsc#1177916)

  - move bcond_with/without up front for e.g. pcmk_release

  - pacemakerd: ignore shutdown requests from unprivileged     users (CVE-2020-25654, bsc#1177916)

  - rpm: add spec option for enabling CIB secrets

  - rpm: put user-configurable items at top of spec

  - rpm: use the user/group ID 90 for haclient/hacluster to     be consistent with cluster-glue (bsc#1167171)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for pacemaker fixes the following issues :

Update to 2.0.4 :

  - based: use crm_exit to free qb-logging

  - cibsecret: don't use pssh -q option unless supported

  - crm_error: use g_free for a proper match

  - crm_mon: NULL output-pointer when buffer is freed

  - crm_resource: avoid unnecessary issus with dynamic     allocation

  - crm_ticket: avoid unnecessary issues with dynamic     allocation

  - executor: restrict certain IPC requests to Pacemaker     daemons (CVE-2020-25654, bsc#1177916)

  - fencer: avoid infinite loop if device is removed during     operation

  - fencer: restrict certain IPC requests to privileged     users (CVE-2020-25654, bsc#1177916)

  - libcrmcommon: free basename after setting prgname

  - libcrmcommon: return ENOMEM directly instead of errno

  - libpe_status: Modify filtering of inactive resources.

  - libreplace: closedir when bailing out dir traversal

  - move bcond_with/without up front for e.g. pcmk_release

  - pacemakerd: ignore shutdown requests from unprivileged     users (CVE-2020-25654, bsc#1177916)

  - resources: attribute name parameter doesn't have to be     unique

  - rpm: add spec option for enabling CIB secrets

  - rpm: put user-configurable items at top of spec

  - rpm: use the user/group ID 90 for haclient/hacluster to     be consistent with cluster-glue (bsc#1167171)

  - scheduler: Add the node name back to bundle instances.

  - silence some false positives static analysis stumbled     over

  - tools: check resource separately from managing parameter     in cibsecret

  - tools: free IPC memory after closing connection

  - tools: improve cibsecret help

  - tools: verify newly created CIB connection is not NULL

This update was imported from the SUSE:SLE-15-SP2:Update update project.

ID	Name	Product	Family	Severity
182196	GLSA-202309-09 : Pacemaker: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
180960	Oracle Linux 7 : pacemaker (ELSA-2020-5453)	Nessus	Oracle Linux Local Security Checks	high
157552	AlmaLinux 8 : pacemaker (ALSA-2020:5487)	Nessus	Alma Linux Local Security Checks	high
154616	NewStart CGSL CORE 5.05 / MAIN 5.05 : pacemaker Vulnerability (NS-SA-2021-0160)	Nessus	NewStart CGSL Local Security Checks	high
147326	NewStart CGSL CORE 5.04 / MAIN 5.04 : pacemaker Vulnerability (NS-SA-2021-0021)	Nessus	NewStart CGSL Local Security Checks	high
145894	CentOS 8 : pacemaker (CESA-2020:5487)	Nessus	CentOS Local Security Checks	high
144974	CentOS 7 : pacemaker (CESA-2020:5453)	Nessus	CentOS Local Security Checks	high
144814	Debian DLA-2519-1 : pacemaker security update	Nessus	Debian Local Security Checks	high
144796	Amazon Linux 2 : pacemaker (ALAS-2021-1583)	Nessus	Amazon Linux Local Security Checks	high
144563	Oracle Linux 8 : pacemaker (ELSA-2020-5487)	Nessus	Oracle Linux Local Security Checks	high
144421	RHEL 7 : pacemaker (RHSA-2020:5453)	Nessus	Red Hat Local Security Checks	high
144392	RHEL 8 : pacemaker (RHSA-2020:5487)	Nessus	Red Hat Local Security Checks	high
144297	Scientific Linux Security Update : pacemaker on SL7.x i686/x86_64 (2020:5453)	Nessus	Scientific Linux Local Security Checks	high
144274	RHEL 8 : pacemaker (RHSA-2020:5423)	Nessus	Red Hat Local Security Checks	high
143356	Fedora 33 : pacemaker (2020-3d0e38b9e7)	Nessus	Fedora Local Security Checks	high
143325	Fedora 32 : pacemaker (2020-2cbe0089e2)	Nessus	Fedora Local Security Checks	high
142920	Debian DSA-4791-1 : pacemaker - security update	Nessus	Debian Local Security Checks	high
142729	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Pacemaker vulnerability (USN-4623-1)	Nessus	Ubuntu Local Security Checks	high
142583	openSUSE Security Update : pacemaker (openSUSE-2020-1825)	Nessus	SuSE Local Security Checks	high
142194	openSUSE Security Update : pacemaker (openSUSE-2020-1782)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-25654

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high