CVE-2022-1049

Description

A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon allowed expired accounts and accounts with expired passwords to log in when using PAM authentication. Unprivileged, expired accounts with previously denied access could still log in.

References

https://huntr.dev/bounties/7aa921fc-a568-4fd8-96f4-7cd826246aa5

https://www.debian.org/security/2022/dsa-5226

https://lists.debian.org/debian-lts-announce/2022/09/msg00017.html

https://huntr.dev/bounties/7aa921fc-a568-4fd8-96f4-7cd826246aa5/

https://bugzilla.redhat.com/show_bug.cgi?id=2066629

https://access.redhat.com/errata/RHSA-2022:7447

https://access.redhat.com/security/cve/CVE-2022-1049

https://access.redhat.com/errata/RHSA-2022:7935

Details

Risk Information

CVSS v2

CVSS v3