The remote host is affected by the vulnerability described in GLSA-202309-09 (Pacemaker: Multiple Vulnerabilities)

  - A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and     including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to     achieve local privilege escalation. (CVE-2018-16877)

  - A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted     preference of uncontrolled processes can lead to DoS (CVE-2018-16878)

  - A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in     certain sensitive information to be leaked via the system logs. (CVE-2019-3885)

  - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the     haclient group could use IPC communication with various daemons directly to perform certain tasks that     they would be prevented by ACLs from doing if they went through the configuration. (CVE-2020-25654)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several security vulnerabilities were addressed in pacemaker, a cluster resource manager.

CVE-2018-16877

A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

CVE-2018-16878

An insufficient verification inflicted preference of uncontrolled processes can lead to denial of service.

CVE-2020-25654

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

For Debian 9 stretch, these problems have been fixed in version 1.1.24-0+deb9u1.

We recommend that you upgrade your pacemaker packages.

For the detailed security status of pacemaker please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/pacemaker

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in pacemaker. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS. (CVE-2018-16878)

A use-after-free flaw was found in pacemaker which could result in certain sensitive information to be leaked via the system logs.
(CVE-2019-3885)

A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.
(CVE-2018-16877)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3935:04 advisory.

    * pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)
      * pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)
      * pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pacemaker packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way pacemaker's client-server     authentication was implemented in versions up to and     including 2.0.0. A local attacker could use this flaw,     and combine it with other IPC weaknesses, to achieve     local privilege escalation. (CVE-2018-16877)

  - A use-after-free flaw was found in pacemaker up to and     including version 2.0.1 which could result in certain     sensitive information to be leaked via the system logs.
    (CVE-2019-3885)

  - A flaw was found in pacemaker up to and including     version 2.0.1. An insufficient verification inflicted     preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1279 advisory.

    - Improve clients' authentication of IPC servers (CVE-2018-16877)
    - Fix use-after-free with potential information disclosure (CVE-2019-3885)
    - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1279 advisory.

    The Pacemaker cluster resource manager is a collection of technologies working together to maintain data     integrity and application availability in the event of failures.

    Security Fix(es):

    * pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)

    * pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

    * pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Interrupted live migration will get full start rather than completed migration (BZ#1695247)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
182196	GLSA-202309-09 : Pacemaker: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	9/29/2023	9/29/2023	high
144814	Debian DLA-2519-1 : pacemaker security update	Nessus	Debian Local Security Checks	1/11/2021	1/30/2024	high
128289	Amazon Linux 2 : pacemaker (ALAS-2019-1275)	Nessus	Amazon Linux Local Security Checks	8/28/2019	5/1/2024	high
288889	MiracleLinux 7 : pacemaker-1.1.19-8.el7.5 (AXSA:2019-3935:04)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
132469	NewStart CGSL CORE 5.05 / MAIN 5.05 : pacemaker Multiple Vulnerabilities (NS-SA-2019-0258)	Nessus	NewStart CGSL Local Security Checks	12/31/2019	5/18/2022	high
127588	Oracle Linux 8 : pacemaker (ELSA-2019-1279)	Nessus	Oracle Linux Local Security Checks	8/12/2019	11/1/2024	high
125446	RHEL 8 : pacemaker (RHSA-2019:1279)	Nessus	Red Hat Local Security Checks	5/28/2019	11/6/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high