CVE-2015-1867
Fixed in a distro release EPSS 3%
Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
Products: redhat enterprise_linux_high_availability, redhat enterprise_linux_resilient_storage, clusterlabs pacemaker
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 6 | pacemaker | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 6 | pacemaker-cli | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 6 | pacemaker-cluster-libs | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 6 | pacemaker-cts | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 6 | pacemaker-debuginfo | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 6 | pacemaker-doc | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 6 | pacemaker-libs | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 6 | pacemaker-libs-devel | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 6 | pacemaker-remote | 0:1.1.12-8.el6 |
| Red Hat Enterprise Linux 7 | pacemaker | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-cli | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-cluster-libs | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-cts | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-debuginfo | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-doc | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-libs | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-libs-devel | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-nagios-plugins-metadata | 0:1.1.13-10.el7 |
| Red Hat Enterprise Linux 7 | pacemaker-remote | 0:1.1.13-10.el7 |