High severity · published Nov 24, 2020
CVE-2020-25654
An ACL bypass flaw was found in pacemaker
7.2
CVSS
1.9%
EPSS
No
On KEV
Description
An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
9.0 · source: NVD
PA
Pacemaker · Clusterlabs
before 1.1.23; 2.0.0 before 2.0.3; 2.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25654
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1888191
Mailing List
https://lists.clusterlabs.org/pipermail/users/2020-October/027840.html
Mailing List
https://lists.debian.org/debian-lts-announce/2021/01/msg00007.html
Mailing List
https://seclists.org/oss-sec/2020/q4/83
security.gentoo.org
https://security.gentoo.org/glsa/202309-09
More from Pacemaker
7.8
CVE-2018-16877
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0
7.8
CVE-2016-7035
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface
7.5
CVE-2019-3885
A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs
7.5
CVE-2016-7797
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection
5.5
CVE-2010-2496
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and…