CVE-2018-16877

moderate-risk

Published 2019-04-18

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (20)

Pacemaker

Ubuntu Linux

Fedora

Debian Linux

Leap

Enterprise Linux

Enterprise Linux Eus

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Affected Vendors

Debian Redhat Canonical Fedoraproject Opensuse Clusterlabs

References (26)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00012.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00034.html

Broken Link http://www.securityfocus.com/bid/108042

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1278

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1279

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16877

Patch https://github.com/ClusterLabs/pacemaker/pull/1749

Mailing List https://lists.debian.org/debian-lts-announce/2021/01/msg00007.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

https://security.gentoo.org/glsa/202309-09

Third Party Advisory https://usn.ubuntu.com/3952-1/

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00012.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00034.html

Broken Link http://www.securityfocus.com/bid/108042

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1278

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1279

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16877

Patch https://github.com/ClusterLabs/pacemaker/pull/1749

and 6 more references

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 0/34 · Minimal

Exposure 20/34 · Moderate