CVE-2018-1079 pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from...
MediumCVSS 6.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pcs(Debian:12) | < 0.9.164-1 | 0.9.164-1 |
| debian/pcs(Debian:13) | < 0.9.164-1 | 0.9.164-1 |
| debian/pcs(Debian:14) | < 0.9.164-1 | 0.9.164-1 |
| clusterlabs pacemaker command line interface | <= 0.9.164 | No fix listed |
| clusterlabs pacemaker command line interface | = 0.10 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux | = 7.5 | No fix listed |
References
- Debian Security Tracker CVE-2018-1079 vendor-advisory
- access.redhat.com third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- bugs.debian.org issue-tracking