Security fix for CVE-2019-3885, CVE-2018-16877, CVE-2018-16878

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pacemaker packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way pacemaker's client-server     authentication was implemented in versions up to and     including 2.0.0. A local attacker could use this flaw,     and combine it with other IPC weaknesses, to achieve     local privilege escalation. (CVE-2018-16877)

  - A use-after-free flaw was found in pacemaker up to and     including version 2.0.1 which could result in certain     sensitive information to be leaked via the system logs.
    (CVE-2019-3885)

  - A flaw was found in pacemaker up to and including     version 2.0.1. An insufficient verification inflicted     preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1278 advisory.

    The Pacemaker cluster resource manager is a collection of technologies working together to maintain data     integrity and application availability in the event of failures.

    Security Fix(es):

    * pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)

    * pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

    * pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3935:04 advisory.

    * pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)
      * pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)
      * pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pacemaker packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way pacemaker's client-server     authentication was implemented in versions up to and     including 2.0.0. A local attacker could use this flaw,     and combine it with other IPC weaknesses, to achieve     local privilege escalation. (CVE-2018-16877)

  - A use-after-free flaw was found in pacemaker up to and     including version 2.0.1 which could result in certain     sensitive information to be leaked via the system logs.
    (CVE-2019-3885)

  - A flaw was found in pacemaker up to and including     version 2.0.1. An insufficient verification inflicted     preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1279 advisory.

    - Improve clients' authentication of IPC servers (CVE-2018-16877)
    - Fix use-after-free with potential information disclosure (CVE-2019-3885)
    - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1279 advisory.

    The Pacemaker cluster resource manager is a collection of technologies working together to maintain data     integrity and application availability in the event of failures.

    Security Fix(es):

    * pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)

    * pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

    * pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Interrupted live migration will get full start rather than completed migration (BZ#1695247)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
124606	Fedora 28 : pacemaker (2019-e71f6f36ac)	Nessus	Fedora Local Security Checks	2019/5/6	2024/5/29	high
131424	NewStart CGSL CORE 5.04 / MAIN 5.04 : pacemaker Multiple Vulnerabilities (NS-SA-2019-0224)	Nessus	NewStart CGSL Local Security Checks	2019/12/2	2022/5/18	high
125445	RHEL 7 : pacemaker (RHSA-2019:1278)	Nessus	Red Hat Local Security Checks	2019/5/28	2024/11/6	high
288889	MiracleLinux 7 : pacemaker-1.1.19-8.el7.5 (AXSA:2019-3935:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
132469	NewStart CGSL CORE 5.05 / MAIN 5.05 : pacemaker Multiple Vulnerabilities (NS-SA-2019-0258)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2022/5/18	high
127588	Oracle Linux 8 : pacemaker (ELSA-2019-1279)	Nessus	Oracle Linux Local Security Checks	2019/8/12	2024/11/1	high
125446	RHEL 8 : pacemaker (RHSA-2019:1279)	Nessus	Red Hat Local Security Checks	2019/5/28	2024/11/6	high

検出

プラグインの検索

high

high

high

high

high

high

high