The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1060 advisory.

  - pcs: Privilege escalation via authorized user malicious REST call (CVE-2018-1079)

  - pcs: Debug parameter removal bypass, allowing information disclosure (CVE-2018-1086)

  - rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

Security Fix(es) :

  - pcs: Privilege escalation via authorized user malicious     REST call (CVE-2018-1079)

  - pcs: Debug parameter removal bypass, allowing     information disclosure (CVE-2018-1086)

  - rack-protection: Timing attack in authenticity_token.rb     (CVE-2018-1000119)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pcs packages installed that are affected by multiple vulnerabilities:

  - Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and     earlier contains a timing attack vulnerability in the     CSRF token checking that can result in signatures can be     exposed. This attack appear to be exploitable via     network connectivity to the ruby application. This     vulnerability appears to have been fixed in 1.5.5 and     2.0.0. (CVE-2018-1000119)

  - It was found that the REST interface of the pcsd service     did not properly sanitize the file name from the     /remote/put_file query. If the /etc/booth directory     exists, an authenticated attacker with write permissions     could create or overwrite arbitrary files with arbitrary     data outside of the /etc/booth directory, in the context     of the pcsd process. (CVE-2018-1079)

  - It was found that the REST interface of the pcsd service     did not properly remove the pcs debug argument from the     /run_pcs query, possibly disclosing sensitive     information. A remote attacker with a valid token could     use this flaw to elevate their privilege.
    (CVE-2018-1086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for pcs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es) :

* pcs: Privilege escalation via authorized user malicious REST call (CVE-2018-1079)

* pcs: Debug parameter removal bypass, allowing information disclosure (CVE-2018-1086)

* rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The CVE-2018-1079 issue was discovered by Ondrej Mular (Red Hat) and the CVE-2018-1086 issue was discovered by Cedric Buissart (Red Hat).

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4366 advisory.

  - mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)

  - puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL (CVE-2018-11751)

  - rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

  - hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219)

  - Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)

  - rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)

  - rubygem-secure_headers: limited header injection when using dynamic overrides with user input     (CVE-2020-5216)

  - rubygem-secure_headers: directive injection when using dynamic overrides with user input (CVE-2020-5217)

  - rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks     (CVE-2020-5267)

  - netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

  - rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)

  - puppet: Arbitrary catalog retrieval (CVE-2020-7942)

  - puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)

  - rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)

  - rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names     (CVE-2020-8184)

  - jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

  - jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

  - jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

  - jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

  - hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

  - jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider (CVE-2020-10968)

  - jackson-databind: Serialization gadgets in javax.swing.JEditorPane (CVE-2020-10969)

  - jackson-databind: Serialization gadgets in org.springframework:spring-aop (CVE-2020-11619)

  - jackson-databind: serialization in weblogic/oracle-aqjms (CVE-2020-14061)

  - jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool     (CVE-2020-14062)

  - jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory (CVE-2020-14195)

  - foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)

  - Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover     (CVE-2020-14380)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A timing attack was discovered in the function for CSRF token validation of the 'Ruby rack protection' framework.

Debug parameter removal bypass, allowing information disclosure

It was found that the REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.
(CVE-2018-1086)

Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
(CVE-2018-1000119)

Privilege escalation via authorized user malicious REST call

It was found that the REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process. (CVE-2018-1079)

From Red Hat Security Advisory 2018:1060 :

An update for pcs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es) :

* pcs: Privilege escalation via authorized user malicious REST call (CVE-2018-1079)

* pcs: Debug parameter removal bypass, allowing information disclosure (CVE-2018-1086)

* rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The CVE-2018-1079 issue was discovered by Ondrej Mular (Red Hat) and the CVE-2018-1086 issue was discovered by Cedric Buissart (Red Hat).

ID	Name	Product	Family	Published	Updated	Severity
108996	RHEL 7 : pcs (RHSA-2018:1060)	Nessus	Red Hat Local Security Checks	4/11/2018	4/27/2024	high
196774	RHEL 6 : rack-protection (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	medium
109456	Scientific Linux Security Update : pcs on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	5/1/2018	2/24/2020	high
127219	NewStart CGSL CORE 5.04 / MAIN 5.04 : pcs Multiple Vulnerabilities (NS-SA-2019-0042)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	1/14/2021	high
110237	CentOS 7 : pcs (CESA-2018:1060)	Nessus	CentOS Local Security Checks	5/31/2018	12/31/2019	high
142452	RHEL 7 : Satellite 6.8 (Important) (RHSA-2020:4366)	Nessus	Red Hat Local Security Checks	11/4/2020	4/28/2024	critical
111112	Debian DSA-4247-1 : ruby-rack-protection - security update	Nessus	Debian Local Security Checks	7/17/2018	11/13/2018	medium
109365	Amazon Linux 2 : pcs (ALAS-2018-1005)	Nessus	Amazon Linux Local Security Checks	4/27/2018	3/21/2019	high
109438	Oracle Linux 7 : pcs (ELSA-2018-1060)	Nessus	Oracle Linux Local Security Checks	5/1/2018	9/27/2019	high

Detections

Analytics

Plugins Search

high

medium

high

high

high

critical

medium

high

high