CVE-2022-1049

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• pcs: improper authentication via PAM (CVE-2022-1049)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• pcs: improper authentication via PAM (CVE-2022-1049)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• pcs: improper authentication via PAM (CVE-2022-1049)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• pcs: improper authentication via PAM (CVE-2022-1049)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
• CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
• CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
• CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
• CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

• CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
• CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
• CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
• CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
• CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.

Cedric Buissart discovered that pcs did not correctly handle certain parameters. An attacker could possibly use this issue to leak sensitive information or elevate their privileges. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-1086)

Ondrej Mular discovered that pcs did not correctly handle Unix socket permissions. An attacker could possibly use this issue to elevate their privileges. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2735)

It was discovered that pcs did not correctly handle PAM authentication. An attacker could possibly use this issue to bypass authentication mechanisms. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-1049)

It was discovered that pcs did not correctly handle the validation of Node names. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2661)