CL
Vendor
Clusterlabs
28
CVEs
0
On KEV
0
New 30D
Products
PA7.8
Pacemaker
Clusterlabs
10 CVEs0 on KEV0 new
PC9.8
Pcs
Clusterlabs
6 CVEs0 on KEV0 new
BO6.5
Booth
Clusterlabs
2 CVEs0 on KEV0 new
FE5.9
Fence-agents
Clusterlabs
2 CVEs0 on KEV0 new
HA9.8
Hawk
Clusterlabs
2 CVEs0 on KEV0 new
LI9.8
Libqb
Clusterlabs
2 CVEs0 on KEV0 new
PC7.5
Pacemaker Command Line Interface
Clusterlabs
2 CVEs0 on KEV0 new
CG5.5
Cluster Glue
Clusterlabs
1 CVEs0 on KEV0 new
CR7.8
Crmsh
Clusterlabs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-3049 | BO Booth Clusterlabs | 5.9 | Jun 6 | A flaw was found in Booth, a cluster ticket manager |
| CVE-2023-39976 | LI Libqb Clusterlabs | 9.8 | Aug 8 | log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered |
| CVE-2023-2319 | PC Pcs Clusterlabs | 9.8 | May 17 | It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue… |
| CVE-2022-2735 | PC Pcs Clusterlabs | 7.8 | Sep 6 | A vulnerability was found in the PCS project |
| CVE-2021-3020 | HA Hawk Clusterlabs | 8.8 | Aug 26 | An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15 |
| CVE-2022-2553 | BO Booth Clusterlabs | 6.5 | Jul 28 | The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node |
| CVE-2022-1049 | PC Pcs Clusterlabs | 8.8 | Mar 25 | A flaw was found in the Pacemaker configuration tool (pcs) |
| CVE-2010-2496 | PA Pacemaker Clusterlabs | 5.5 | Oct 18 | stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and… |
| CVE-2020-35459 | CR Crmsh Clusterlabs | 7.8 | Jan 12 | An issue was discovered in ClusterLabs crmsh through 4.2.1 |
| CVE-2020-35458 | HA Hawk Clusterlabs | 9.8 | Jan 12 | An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x |
| CVE-2020-25654 | PA Pacemaker Clusterlabs | 7.2 | Nov 24 | An ACL bypass flaw was found in pacemaker |
| CVE-2014-0104 | FE Fence-agents Clusterlabs | 5.9 | Jan 2 | In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL… |
| CVE-2011-5271 | PA Pacemaker Clusterlabs | 5.5 | Nov 12 | Pacemaker before 1.1.6 configure script creates temporary files insecurely |
| CVE-2019-10153 | FE Fence-agents Clusterlabs | 5.0 | Jul 30 | A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an… |
| CVE-2019-12779 | LI Libqb Clusterlabs | 7.1 | Jun 7 | libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL |
| CVE-2019-3885 | PA Pacemaker Clusterlabs | 7.5 | Apr 18 | A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs |
| CVE-2018-16878 | PA Pacemaker Clusterlabs | 5.5 | Apr 18 | A flaw was found in pacemaker up to and including version 2.0.1 |
| CVE-2018-16877 | PA Pacemaker Clusterlabs | 7.8 | Apr 18 | A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0 |
| CVE-2016-7035 | PA Pacemaker Clusterlabs | 7.8 | Sep 10 | An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface |
| CVE-2018-1079 | PC Pacemaker Command Line Interface Clusterlabs | 6.5 | Apr 12 | pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call |
| CVE-2018-1086 | PC Pacemaker Command Line Interface Clusterlabs | 7.5 | Apr 12 | pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass |
| CVE-2017-2661 | PC Pcs Clusterlabs | 6.1 | Mar 12 | ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding… |
| CVE-2016-0721 | PC Pcs Clusterlabs | 8.1 | Apr 21 | Session fixation vulnerability in pcsd in pcs before 0.9.157 |
| CVE-2016-0720 | PC Pcs Clusterlabs | 8.8 | Apr 21 | Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149 |
| CVE-2016-7797 | PA Pacemaker Clusterlabs | 7.5 | Mar 24 | Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection |
| CVE-2015-1867 | PA Pacemaker Clusterlabs | – | Aug 12 | Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command |
| CVE-2013-0281 | PA Pacemaker Clusterlabs | – | Nov 23 | Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets,… |