SB2020121575 - Red Hat Enterprise Linux 8.2 Extended Update Support update for pacemaker 



SB2020121575 - Red Hat Enterprise Linux 8.2 Extended Update Support update for pacemaker

Published: December 15, 2020

Security Bulletin ID SB2020121575
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper access control (CVE-ID: CVE-2020-25654)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in pacemaker. A local account on the cluster and in the haclient group can use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.


Remediation

Install update from vendor's website.