Clusterlabs vulnerabilities, page 2
27 vulnerabilities
Known vulnerabilities in Clusterlabs products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
CVE-2017-2661clusterlabspcs+2
EPSS score1.18%
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.CVE-2024-3049clusterlabsbooth+25EPSS score0.53%
A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.CVE-2019-10153clusterlabsfence-agents+57EPSS score2.17%
A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member.CVE-2019-12779clusterlabslibqb+19EPSS score0.66%
libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.CVE-2019-3885canonicalubuntu_linux+4EPSS score1.90%
A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs.CVE-2023-2319clusterlabspcs+2EPSS score0.97%
It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.CVE-2023-39976clusterlabslibqb+18EPSS score1.18%
log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.