CVE-2019-10153

moderate-risk
Published 2019-07-30

A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member.

Do I need to act?

-
0.35% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.0/10 Medium
NETWORK / LOW complexity

Affected Products (4)

Fence-Agents

Affected Vendors

Redhat Clusterlabs

References (8)

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2037
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10153
Patch https://github.com/ClusterLabs/fence-agents/pull/255
Patch https://github.com/ClusterLabs/fence-agents/pull/272
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2037
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10153
Patch https://github.com/ClusterLabs/fence-agents/pull/255
Patch https://github.com/ClusterLabs/fence-agents/pull/272
31
/ 100
moderate-risk
Severity 20/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 10/34 · Low