CVE-2018-16877
Fixed in a distro release EPSS <1%CVSS 8.8
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.
Products: clusterlabs pacemaker
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | pacemaker | 1.1.20-5.amzn2.0.2 |
| Amazon Linux 2 | pacemaker-cli | 1.1.20-5.amzn2.0.2 |
| Amazon Linux 2 | pacemaker-cluster-libs | 1.1.20-5.amzn2.0.2 |
| Amazon Linux 2 | pacemaker-cts | 1.1.20-5.amzn2.0.2 |
| Amazon Linux 2 | pacemaker-doc | 1.1.20-5.amzn2.0.2 |
| Amazon Linux 2 | pacemaker-libs | 1.1.20-5.amzn2.0.2 |
| Amazon Linux 2 | pacemaker-libs-devel | 1.1.20-5.amzn2.0.2 |
| Amazon Linux 2 | pacemaker-nagios-plugins-metadata | 1.1.20-5.amzn2.0.2 |
| Amazon Linux 2 | pacemaker-remote | 1.1.20-5.amzn2.0.2 |
| Debian 12 | pacemaker | 2.0.1-3 |
| Debian 13 | pacemaker | 2.0.1-3 |
| Debian 14 | pacemaker | 2.0.1-3 |
| Debian 9 | pacemaker | 1.1.24-0+deb9u1 |
| Red Hat Enterprise Linux 7 | pacemaker | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-cli | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-cluster-libs | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-cts | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-debuginfo | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-doc | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-libs | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-libs-devel | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-nagios-plugins-metadata | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 7 | pacemaker-remote | 0:1.1.19-8.el7_6.5 |
| Red Hat Enterprise Linux 8 | pacemaker | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-cli | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-cli-debuginfo | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-cluster-libs | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-cluster-libs-debuginfo | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-cts | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-debuginfo | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-debugsource | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-doc | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-libs | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-libs-debuginfo | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-libs-devel | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-nagios-plugins-metadata | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-remote | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-remote-debuginfo | 0:2.0.1-4.el8_0.3 |
| Red Hat Enterprise Linux 8 | pacemaker-schemas | 0:2.0.1-4.el8_0.3 |
| SUSE Linux Enterprise High Availability Extension 12 SP2 | pacemaker | 1.1.15-23.9.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP3 | pacemaker | 1.1.16-6.14.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP4 | pacemaker | 1.1.19+20181105.ccd6b5b10-3.10.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP4 | pacemaker | 1.1.19+20181105.ccd6b5b10-3.13.1 |
| SUSE Linux Enterprise High Availability Extension 15 | pacemaker | 1.1.18+20180430.b12c320f5-3.9.4 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | pacemaker | 1.1.16-6.14.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | pacemaker | 1.1.19+20181105.ccd6b5b10-3.10.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | pacemaker | 1.1.19+20181105.ccd6b5b10-3.13.1 |
| Ubuntu 16.04 LTS | pacemaker | 1.1.14-2ubuntu1.6 |
| Ubuntu 18.04 LTS | pacemaker | 1.1.18-0ubuntu1.1 |
| openSUSE Leap 15.0 | pacemaker | 1.1.18+20180430.b12c320f5-lp150.2.9.1 |