CVE-2015-5190: Command Injection
It was reported that pcs package is vulnerable to command injection with root privileges. A user supplied string is used to in running a system command. If the user uses escape characters they can run a command as the root user on the system.
To do this the user must already have access to login to pcsd (Be a member of the hacluster group).
Other sources
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5190?
The severity of CVE-2015-5190 is classified as high due to its potential for command injection with root privileges.
How do I fix CVE-2015-5190?
To fix CVE-2015-5190, update the pacemaker/corosync configuration system to version 0.9.140 or later.
What systems are affected by CVE-2015-5190?
CVE-2015-5190 affects the Pacemaker/Corosync Configuration System version 0.9.139 and earlier.
Can a non-privileged user exploit CVE-2015-5190?
No, a user must have existing login access to the system to exploit CVE-2015-5190.
What actions can be taken to mitigate CVE-2015-5190?
To mitigate CVE-2015-5190, restrict user access to the system and apply the software update as soon as possible.