This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.
The remote Scientific Linux host is missing one or more security
The following packages have been upgraded to a newer upstream version:
Security Fix(es) :
- A Cross-Site Request Forgery (CSRF) flaw was found in
the pcsd web UI. A remote attacker could provide a
specially crafted web page that, when visited by a user
with a valid pcsd session, would allow the attacker to
trigger requests on behalf of the user, for example
removing resources or restarting/removing nodes.
- It was found that pcsd did not invalidate cookies on the
server side when a user logged out. This could
potentially allow an attacker to perform session
fixation attacks on pcsd. (CVE-2016-0721)
These issues were discovered by Martin Prpic (Red Hat Product
Additional Changes :
See also :
Update the affected pcs and / or pcs-debuginfo packages.
Risk factor :
Medium / CVSS Base Score : 6.8