Unscored severity · published Nov 23, 2013
CVE-2013-0281
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets,…
–
CVSS
2.6%
EPSS
No
On KEV
Description
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
6.0 · source: NVD
PA
Pacemaker · Clusterlabs
1.1.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0281
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0281
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1635.html
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=891922
Exploit
https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93
More from Pacemaker
7.8
CVE-2018-16877
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0
7.8
CVE-2016-7035
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface
7.5
CVE-2019-3885
A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs
7.5
CVE-2016-7797
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection
7.2
CVE-2020-25654
An ACL bypass flaw was found in pacemaker