CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2015-1867 – pacemaker: acl read-only access allow role assignment
https://notcve.org/view.php?id=CVE-2015-1867
Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command. Vulnerabilidad en Pacemaker en versiones anteriores a 1.1.13, no evalúa correctamente nodos añadidos, lo que permite a usuarios remotos de sólo lectura obtener privilegios a través de un comando de acl. A flaw was found in the way pacemaker, a cluster resource manager, evaluated added nodes in certain situations. A user with read-only access could potentially assign any other existing roles to themselves and then add privileges to other users as well. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170610.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169671.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169995.html http://rhn.redhat.com/errata/RHSA-2015-1424.html http://rhn.redhat.com/errata/RHSA-2015-2383.html http://www.securityfocus.com/bid/74231 https://bugzilla.redhat.com/show_bug.cgi?id=1211370 https://github.com/ClusterLabs/pacemaker/commit/84ac07c https: • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2013-0281 – pacemaker: remote DoS when CIB management is enabled caused by use of blocking sockets
https://notcve.org/view.php?id=CVE-2013-0281
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking). Pacemaker 1.1.10, cuando la configuración o recurso de la administración remota Cluster Information Base (CIB) está activada, no limita la duración de las conexiones hacia los sockets de bloqueo, lo que permite a atacantes remotos provocar una denegación de servicio (bloqueo de conexión). • http://rhn.redhat.com/errata/RHSA-2013-1635.html https://bugzilla.redhat.com/show_bug.cgi?id=891922 https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93 https://access.redhat.com/security/cve/CVE-2013-0281 • CWE-399: Resource Management Errors •