Fluid Attacks Database

Description

A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster" token, this flaw allows an attacker to have complete control over the cluster managed by PCS.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	pcs	>=0 <0.11.3-2	0.11.3-2
debian 11	pcs	=0.10.8-1 \|\| >=0 <0.10.8-1+deb11u1	0.10.8-1+deb11u1
debian 13	pcs	>=0 <0.11.3-2	0.11.3-2
debian 14	pcs	>=0 <0.11.3-2	0.11.3-2
rpm rhel8.2	pcs	<0:0.10.4-6.el8_2.3	0:0.10.4-6.el8_2.3
rpm rhel9	pcs	<0:0.11.1-10.el9_0.2	0:0.11.1-10.el9_0.2
rpm rhel8	pcs	<0:0.10.12-6.el8_6.2	0:0.10.12-6.el8_6.2
rpm rhel8.4	pcs	<0:0.10.8-1.el8_4.2	0:0.10.8-1.el8_4.2

Aliases

1. CVE-2022-27352. NVD-2022-27353. OSV-DEBIAN-2022-27354. OSV-2022-27355. SECURITY-TRACKER-CVE-2022-2735

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.