CVE-2019-3885

A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs.

The updated packages fix security vulnerabilities:

A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs. (CVE-2019-3885)

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation. (CVE-2018-16877)

A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS. (CVE-2018-16878)

This update for pacemaker fixes the following issues:

Security issues fixed:

• CVE-2019-3885: Fixed an information disclosure in log output. (bsc#1131357)
• CVE-2018-16877: Fixed a local privilege escalation through insufficient IPC client-server authentication. (bsc#1131356)
• CVE-2018-16878: Fixed a denial of service through insufficient verification inflicted preference of uncontrolled processes. (bsc#1131353)

Non-security issue fixed:

• crmd: delete resource from lrmd when appropriate to avoid timeouts with crmsh (bsc#1117381).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libpacemaker-devel-2.1.0+20210816.c6a4f6e6c-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pacemaker fixes the following issues:

Security issues fixed:

• CVE-2019-3885: Fixed an information disclosure in log output. (bsc#1131357)
• CVE-2018-16877: Fixed a local privilege escalation through insufficient IPC client-server authentication. (bsc#1131356)
• CVE-2018-16878: Fixed a denial of service through insufficient verification inflicted preference of uncontrolled processes. (bsc#1131353)

Non-security issue fixed:

• scheduler: Respect the order of constraints when relevant resources are being probed. (bsc#1117934, bsc#1128374)

This update for pacemaker fixes the following issues:

Security issues fixed:

• CVE-2019-3885: Fixed an information disclosure in log output. (bsc#1131357)
• CVE-2018-16877: Fixed a local privilege escalation through insufficient IPC client-server authentication. (bsc#1131356)
• CVE-2018-16878: Fixed a denial of service through insufficient verification inflicted preference of uncontrolled processes. (bsc#1131353)

Non-security issue fixed:

• crmd: delete resource from lrmd when appropriate to avoid timeouts with crmsh (bsc#1117381).

Jan Pokorný discovered that Pacemaker incorrectly handled client-server authentication. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-16877)

Jan Pokorný discovered that Pacemaker incorrectly handled certain verifications. A local attacker could possibly use this issue to cause a denial of service. (CVE-2018-16878)

Jan Pokorný discovered that Pacemaker incorrectly handled certain memory operations. A local attacker could possibly use this issue to obtain sensitive information in log outputs. This issue only applied to Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-3885)