[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <5c545c03-5ae3-8ad5-f3e1-b6b8c6f873e7@redhat.com>
Date: Wed, 17 Apr 2019 15:10:23 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
Subject: 3 pacemaker security flaws
Hello all,
Jan Pokorný from Red Hat has discovered 3 security issues with the
pacemaker package. Details and proposed patches are available in this email.
Proposed unembargo date/time is: 10th April, 10:00 UTC
1. CVE-2018-16877 pacemaker: Insufficient local IPC client-server
authentication on the client's side can lead to local privesc:
A flaw was found in the way pacemaker's client-server authentication was
implemented. A local attacker could use this flaw, and combine it with
other IPC weaknesses, to achieve local privilege escalation.
2. CVE-2018-16878 pacemaker: Insufficient verification inflicted
preference of uncontrolled processes can lead to DoS:
A flaw was found in pacemaker. An insufficient verification inflicted
preference of uncontrolled processes can lead to DoS
3. CVE-2019-3885 pacemaker: Information disclosure through use-after-free:
A use-after-free defect was discovered in pacemaker that can possibly
lead to unsolicited information disclosure in the log outputs.
Enclosed are the final patches:
(We would like to thank Suse folks who found issues in the initial set
of patches we sent to distros)
--
Huzaifa Sidhpurwala / Red Hat Product Security Team
View attachment "master.patch" of type "text/x-patch" (95468 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
