Vulnerability Description
Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
CVSS Score
7.5
HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Linux High Availability | 6.0 |
| Redhat | Enterprise Linux Resilient Storage | 6.0 |
| Clusterlabs | Pacemaker | <= 1.1.12 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170610.h
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169671.ht
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169995.ht
- http://rhn.redhat.com/errata/RHSA-2015-1424.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-2383.htmlThird Party Advisory
- http://www.securityfocus.com/bid/74231Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1211370Issue Tracking
- https://github.com/ClusterLabs/pacemaker/commit/84ac07c
- https://security.gentoo.org/glsa/201710-08
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170610.h
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169671.ht
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169995.ht
- http://rhn.redhat.com/errata/RHSA-2015-1424.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-2383.htmlThird Party Advisory
- http://www.securityfocus.com/bid/74231Third Party Advisory
FAQ
What is CVE-2015-1867?
CVE-2015-1867 is a vulnerability with a CVSS score of 7.5 (HIGH). Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
How severe is CVE-2015-1867?
CVE-2015-1867 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-1867?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux High Availability, Redhat Enterprise Linux Resilient Storage, Clusterlabs Pacemaker.