CVE-2022-1049
First published: Fri Mar 25 2022(Updated: )
A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ClusterLabs pcs | <=0.11.2 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| debian/pcs | <=0.10.1-2 | 0.10.1-2+deb10u1 0.10.8-1+deb11u1 0.11.5-1+deb12u1 0.11.6-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://huntr.dev/bounties/7aa921fc-a568-4fd8-96f4-7cd826246aa5
- https://lists.debian.org/debian-lts-announce/2022/09/msg00017.html
- https://www.debian.org/security/2022/dsa-5226
- https://github.com/ClusterLabs/pcs/commit/fb860005117dc9e092649687dfa1304fb423efc5
- https://github.com/ClusterLabs/pcs/commit/8378cf1a81efc0cd421483234943057e2be0a8ed
- https://security-tracker.debian.org/tracker/CVE-2022-1049
Frequently Asked Questions
What is CVE-2022-1049?
CVE-2022-1049 is a vulnerability found in the Pacemaker configuration tool (pcs) that allows expired and expired password accounts to login using PAM authentication.
What is the severity of CVE-2022-1049?
The severity of CVE-2022-1049 is high, with a severity value of 8.8.
How does CVE-2022-1049 affect the software?
CVE-2022-1049 affects systems running pcs version 0.10.1-2 up to and including 0.11.2, as well as ClusterLabs pcs and Debian Debian Linux versions 10.0 and 11.0.
How can I fix CVE-2022-1049?
To fix CVE-2022-1049, upgrade the pcs package to version 0.10.1-2+deb10u1, 0.10.8-1+deb11u1, 0.11.5-1, or 0.11.6-1, depending on your system.
Where can I find more information about CVE-2022-1049?
You can find more information about CVE-2022-1049 at the following references: [link1], [link2], [link3].
- collector/nvd-index
- collector/nvd-api
- collector/security-tracker-debian
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/clusterlabs
- canonical/clusterlabs pcs
- version/clusterlabs pcs/0.11.2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- package-manager/debian