{"id":"CVE-2013-0281","aliases":["DEBIAN-CVE-2013-0281","EUVD-2013-0305","GHSA-9mhm-24f3-gp3v","MGASA-2014-0069","RHSA-2013:1635","UBUNTU-CVE-2013-0281"],"status":"published","title":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management...","description":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02607,"percentile":0.855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2013-11-23T11:00:00Z","modified":"2026-09-01T20:02:28Z","fixes":[{"ecosystem":"Debian:12","package":"pacemaker","fixed_in":["1.1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pacemaker","fixed_in":["1.1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pacemaker","fixed_in":["1.1.10-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"pacemaker","fixed_in":["1.1.8-4.1.mga3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-cli","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-cluster-libs","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-cts","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-debuginfo","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-doc","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-libs","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-libs-devel","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-remote","fixed_in":["0:1.1.10-14.el6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-4.1.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-cluster-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-cts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pacemaker-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.10-14.el6"}]}]}],"products":[{"vendor":"clusterlabs","product":"pacemaker"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1635.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=891922","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0281","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9mhm-24f3-gp3v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0281","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0069.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11724","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2013-0281.html","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=891922#c5","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1635","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=902407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=902459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1011618","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1635.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0281","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2013-0281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0281","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/02/14/6","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-0281","description":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).","status":"published","published":"2013-11-23T11:00:00Z","modified":"2024-08-06T14:18:09.643Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2013-0305","description":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).","status":"published","published":"2013-11-23T11:00:00Z","modified":"2024-08-06T14:18:09Z","updated_at":"2026-11-03T01:56:45.704567Z"}],"ghsa":[{"id":"GHSA-9mhm-24f3-gp3v","title":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management...","description":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).","status":"published","published":"2022-05-05T02:48:44Z","modified":"2023-02-01T05:01:58Z","updated_at":"2026-11-02T14:49:49.102034Z"}],"nvd":[{"id":"CVE-2013-0281","description":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).","status":"published","published":"2013-11-23T11:55:04.287Z","modified":"2026-06-16T23:49:06.893Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:40.988689Z"}],"osv":[{"id":"CVE-2013-0281","description":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).","status":"published","published":"2013-11-23T11:55:04Z","modified":"2026-04-16T06:22:41.918509439Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0281","description":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).","status":"published","published":"2013-11-23T11:55:04.287Z","modified":"2026-09-01T20:02:28.489378642Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"MGASA-2014-0069","title":"Updated pacemaker package fixes one security issue","description":"A denial of service flaw was found in the way Pacemaker performed\nauthentication and processing of remote connections in certain\ncircumstances. When Pacemaker was configured to allow remote Cluster\nInformation Base (CIB) configuration or resource management, a remote\nattacker could use this flaw to cause Pacemaker to block indefinitely\n(preventing it from serving other requests) (CVE-2013-0281).\n","status":"published","published":"2014-02-14T20:51:01Z","modified":"2026-04-16T06:24:11.908771859Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2013:1635","title":"Red Hat Security Advisory: pacemaker security, bug fix, and enhancement update","status":"published","published":"2024-09-15T21:00:40Z","modified":"2026-06-26T10:22:45Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-0281","description":"Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).","status":"withdrawn","published":"2013-11-23T11:55:00Z","modified":"2025-07-16T07:31:06.989658Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}