CVE-2020-25654: Critical severity ClusterLabs Pacemaker vulnerability
An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.
Other sources
An ACL bypass flaw was found in Pacemaker. This flaw allows an attacker with a local account on the cluster and in the haclient group to use IPC communication with various daemons to directly perform certain tasks that would be prevented if they had gone through configured ACLs. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
An acl bypass flaw was found in pacemaker. When ACLs are not in use, any user in the haclient group has full access to the configuration, which effectively gives them the ability to run any code as root.
When ACLs are in use, users still must be in the haclient group, but their read and write access to various parts of the configuration is limited by configured ACLs.
The vulnerability is that users may use IPC communication with the various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this security flaw?
The vulnerability ID is CVE-2020-25654.
What is the severity level of CVE-2020-25654?
The severity level of CVE-2020-25654 is critical with a CVSS score of 7.2.
What is the affected software for CVE-2020-25654?
The affected software for CVE-2020-25654 is Clusterlabs Pacemaker versions up to and including 1.1.23, versions between 2.0.0 and 2.0.3, and version 2.0.5-rc1. It also affects Debian Debian Linux version 9.0.
How can an attacker exploit CVE-2020-25654?
An attacker with a local account on the cluster and in the haclient group can use IPC communication with various daemons to directly perform certain tasks that would be prevented if they had gone through configured ACLs.
What is the fix for CVE-2020-25654?
The fix for CVE-2020-25654 is to upgrade to Clusterlabs Pacemaker version 1.1.24 or later, or version 2.0.5 or later. For Debian Debian Linux, update to version 9.0 or later.