Every CVE Search/ Get API key

CVE-2023-2319

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of...

9.8 Critical

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.97%Up 0.9 points since May 18, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.

Record
CVE-2023-2319
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
CVE List 9.8

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.

Record
CVE-2023-2319
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2023-33823 9.8

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.

Record
EUVD-2023-33823
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-6rhm-fw89-rh2q 9.8

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of...

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.

Record
GHSA-6rhm-fw89-rh2q
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:2652 9.1

Red Hat Security Advisory: pcs security and bug fix update

Record
RHSA-2023:2652
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2023:2652 No score

Important: pcs security and bug fix update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • pcs: webpack: Regression of CVE-2023-28154 fixes in the AlmaLinux (CVE-2023-2319)
  • rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)
  • rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697)
  • Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704)
  • [WebUI] fence levels prevent loading of cluster status (BZ#2183180)
Record
ALSA-2023:2652
Updated
2026-11-02
OSVRLSA-2023:2652 No score

Important: pcs security and bug fix update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • pcs: webpack: Regression of CVE-2023-28154 fixes in the Rocky Linux (CVE-2023-2319)

  • rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

  • rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697)

  • Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704)

  • [WebUI] fence levels prevent loading of cluster status (BZ#2183180)

Record
RLSA-2023:2652
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pcs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 0.11.4-7.el9_2
0.11.4-7.el9_2
pcs-snmp
AlmaLinux:9
From an advisory covering 4 CVEs
 before 0.11.4-7.el9_2
0.11.4-7.el9_2
pcs
Red Hat:enterprise_linux:9::highavailability
From an advisory covering 3 CVEs
 before 0:0.11.4-7.el9_2
0:0.11.4-7.el9_2
pcs-snmp
Red Hat:enterprise_linux:9::highavailability
From an advisory covering 3 CVEs
 before 0:0.11.4-7.el9_2
0:0.11.4-7.el9_2
pcs
Red Hat:enterprise_linux:9::resilientstorage
From an advisory covering 3 CVEs
 before 0:0.11.4-7.el9_2
0:0.11.4-7.el9_2
pcs-snmp
Red Hat:enterprise_linux:9::resilientstorage
From an advisory covering 3 CVEs
 before 0:0.11.4-7.el9_2
0:0.11.4-7.el9_2
pcs
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:0.11.4-7.el9_2
0:0.11.4-7.el9_2

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2319 is a critical vulnerability (CVSS 9.8) in Clusterlabs Pcs, published May 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. No source names a fixed version.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open