Every CVE Search/ Get API key

CVE-2021-3020

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the...

8.8 HighFix available

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.25%Up 0.4 points since Aug 26, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

Record
CVE-2021-3020
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
CVE List No score

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

Record
CVE-2021-3020
Updated
2026-11-02
EUVDEUVD-2021-26373 No score

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

Record
EUVD-2021-26373
Updated
2026-11-03
GitHub AdvisoriesGHSA-cw6w-5gqc-jh8j 8.8

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the...

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

Record
GHSA-cw6w-5gqc-jh8j
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
OSV 8.8

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

Record
CVE-2021-3020
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2023-0073 No score

Updated crmsh packages fix security vulnerability

Privilege escalation (CVE-2021-3020) and other fixes.

Record
MGASA-2023-0073
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2021:0410-1 No score

Security update for crmsh

This update for crmsh fixes the following issues:

  • Update to version 4.3.0+20210305.9db5c9a8:

    • Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
    • Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
    • Fix: ui_configure: raise error when params not exist(bsc#1180126)
    • Dev: doc: remove doc for crm node status
    • Dev: ui_node: remove status subcommand

  • Update to version 4.3.0+20210219.5d1bf034:

    • Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
    • Dev: utils: change default file mod as 644 for str2file function
    • Dev: hb_report: Detect if any ocfs2 partitions exist
    • Dev: lock: give more specific error message when raise ClaimLockError
    • Fix: Replace mktemp() to mkstemp() for security
    • Fix: Remove the duplicate --cov-report html in tox.
    • Fix: fix some lint issues.
    • Fix: Replace utils.msg_info to task.info
    • Fix: Solve a circular import error of utils.py
    • Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
    • Dev: corosync: change the permission of corosync.conf to 644
    • Fix: preflight_check: task: raise error when report_path isn't a directory
    • Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
    • Dev: Polish the sbd feature.
    • Dev: Replace -f with -c and run check when no parameter provide.
    • Fix: Fix the yes option not working
    • Fix: Remove useless import and show help when no input.
    • Dev: Correct SBD device id inconsistenc during ASR
    • Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
    • Dev: Makefile.am: change makefile to integrate preflight_check
    • Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
    • Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:0410-1
Updated
2026-11-02
OSVSUSE-SU-2021:0722-1 No score

Security update for crmsh

This update for crmsh fixes the following issues:

  • Update to version 4.1.0+git.1614156984.f4f5e146:
    • Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Dev: utils: change default file mod as 644 for str2file function
    • Dev: lock: give more specific error message when raise ClaimLockError
    • Dev: hb_report: Detect if any ocfs2 partitions exist
    • Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
    • Dev: corosync: change the permission of corosync.conf to 644
    • Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
    • Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)
Record
SUSE-SU-2021:0722-1
Updated
2026-11-02
OSVSUSE-SU-2021:0771-1 No score

Security update for crmsh

This update for crmsh fixes the following issues:

  • Update to version 3.0.4+git.1614156978.4c1dc46d:
    • Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Dev: utils: change default file mod as 644 for str2file function
    • Dev: lock: give more specific error message when raise ClaimLockError
    • Dev: corosync: change the permission of corosync.conf to 644
    • Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
    • Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)
Record
SUSE-SU-2021:0771-1
Updated
2026-11-02
OSVSUSE-SU-2021:0781-1 No score

Security update for crmsh

This update for crmsh fixes the following issues:

  • Update to version 4.3.0+20210305.9db5c9a8:

    • Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
    • Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
    • Fix: ui_configure: raise error when params not exist(bsc#1180126)
    • Dev: doc: remove doc for crm node status
    • Dev: ui_node: remove status subcommand

  • Update to version 4.3.0+20210219.5d1bf034:

    • Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
    • Dev: utils: change default file mod as 644 for str2file function
    • Dev: hb_report: Detect if any ocfs2 partitions exist
    • Dev: lock: give more specific error message when raise ClaimLockError
    • Fix: Replace mktemp() to mkstemp() for security
    • Fix: Remove the duplicate --cov-report html in tox.
    • Fix: fix some lint issues.
    • Fix: Replace utils.msg_info to task.info
    • Fix: Solve a circular import error of utils.py
    • Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
    • Dev: corosync: change the permission of corosync.conf to 644
    • Fix: preflight_check: task: raise error when report_path isn't a directory
    • Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
    • Dev: Polish the sbd feature.
    • Dev: Replace -f with -c and run check when no parameter provide.
    • Fix: Fix the yes option not working
    • Fix: Remove useless import and show help when no input.
    • Dev: Correct SBD device id inconsistenc during ASR
    • Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
    • Dev: Makefile.am: change makefile to integrate preflight_check
    • Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
    • Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)
Record
SUSE-SU-2021:0781-1
Updated
2026-11-02
OSVSUSE-SU-2021:0782-1 No score

Security update for crmsh

This update for crmsh fixes the following issues:

  • Update to version 4.3.0+20210219.5d1bf034:
    • Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
    • Dev: utils: change default file mod as 644 for str2file function
    • Dev: hb_report: Detect if any ocfs2 partitions exist
    • Dev: lock: give more specific error message when raise ClaimLockError
    • Fix: Replace mktemp() to mkstemp() for security
    • Fix: Remove the duplicate --cov-report html in tox.
    • Fix: fix some lint issues.
    • Fix: Replace utils.msg_info to task.info
    • Fix: Solve a circular import error of utils.py
    • Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
    • Dev: corosync: change the permission of corosync.conf to 644
    • Fix: preflight_check: task: raise error when report_path isn't a directory
    • Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
    • Dev: Polish the sbd feature.
    • Dev: Replace -f with -c and run check when no parameter provide.
    • Fix: Fix the yes option not working
    • Fix: Remove useless import and show help when no input.
    • Dev: Correct SBD device id inconsistenc during ASR
    • Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
    • Dev: Makefile.am: change makefile to integrate preflight_check
    • Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
    • Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)
Record
SUSE-SU-2021:0782-1
Updated
2026-11-02
OSVSUSE-SU-2021:0806-1 No score

Security update for crmsh

This update for crmsh fixes the following issues:

  • Update to version 4.3.0+20210219.5d1bf034:
    • Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
    • Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
    • Dev: utils: change default file mod as 644 for str2file function
    • Dev: hb_report: Detect if any ocfs2 partitions exist
    • Dev: lock: give more specific error message when raise ClaimLockError
    • Fix: Replace mktemp() to mkstemp() for security
    • Fix: Remove the duplicate --cov-report html in tox.
    • Fix: fix some lint issues.
    • Fix: Replace utils.msg_info to task.info
    • Fix: Solve a circular import error of utils.py
    • Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
    • Dev: corosync: change the permission of corosync.conf to 644
    • Fix: preflight_check: task: raise error when report_path isn't a directory
    • Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
    • Dev: Polish the sbd feature.
    • Dev: Replace -f with -c and run check when no parameter provide.
    • Fix: Fix the yes option not working
    • Fix: Remove useless import and show help when no input.
    • Dev: Correct SBD device id inconsistenc during ASR
    • Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
    • Dev: Makefile.am: change makefile to integrate preflight_check
    • Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
    • Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)
Record
SUSE-SU-2021:0806-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
crmsh
Mageia:8
 before 4.4.0-1.mga8
4.4.0-1.mga8
crmsh
SUSE:Linux Enterprise High Availability Extension 12 SP4
From an advisory covering 2 CVEs
 before 4.1.0+git.1614156984.f4f5e146-2.56.2
4.1.0+git.1614156984.f4f5e146-2.56.2
crmsh
SUSE:Linux Enterprise High Availability Extension 12 SP5
From an advisory covering 2 CVEs
 before 4.1.0+git.1614156984.f4f5e146-2.56.2
4.1.0+git.1614156984.f4f5e146-2.56.2
crmsh
SUSE:Linux Enterprise High Availability Extension 12 SP3
From an advisory covering 2 CVEs
 before 3.0.4+git.1614156978.4c1dc46d-13.62.1
3.0.4+git.1614156978.4c1dc46d-13.62.1
crmsh
SUSE:Linux Enterprise High Availability Extension 15 SP2
From an advisory covering 2 CVEs
 before 4.3.0+20210305.9db5c9a8-5.42.1
4.3.0+20210305.9db5c9a8-5.42.1
crmsh
SUSE:Linux Enterprise High Availability Extension 15 SP1
From an advisory covering 2 CVEs
 before 4.3.0+20210219.5d1bf034-3.57.3
4.3.0+20210219.5d1bf034-3.57.3
crmsh
SUSE:Linux Enterprise High Availability Extension 15
From an advisory covering 2 CVEs
 before 4.3.0+20210219.5d1bf034-3.62.3
4.3.0+20210219.5d1bf034-3.62.3
crmsh
openSUSE:Leap 15.2
From an advisory covering 2 CVEs
 before 4.3.0+20210305.9db5c9a8-lp152.4.47.1
4.3.0+20210305.9db5c9a8-lp152.4.47.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3020 is a high vulnerability (CVSS 8.8) in Clusterlabs Hawk, published March 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in crmsh 4.4.0-1.mga8.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open