{"id":"CVE-2016-7797","aliases":["DEBIAN-CVE-2016-7797","EUVD-2016-8647","GHSA-gp6f-9wm3-5hr4","RHSA-2016:2578","SUSE-SU-2016:2869-1","SUSE-SU-2016:2974-1","SUSE-SU-2016:3162-1","UBUNTU-CVE-2016-7797","USN-3462-1","openSUSE-SU-2024:10507-1"],"status":"published","title":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a...","description":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0325,"percentile":0.88412,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-254"],"published":"2016-11-22T11:05:30Z","modified":"2026-10-20T13:19:33Z","fixes":[{"ecosystem":"Debian:12","package":"pacemaker","fixed_in":["1.1.15~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pacemaker","fixed_in":["1.1.15~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pacemaker","fixed_in":["1.1.15~rc3-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-cli","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-cluster-libs","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-cts","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-debuginfo","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-doc","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-libs","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-libs-devel","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-nagios-plugins-metadata","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-remote","fixed_in":["0:1.1.15-11.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"pacemaker","fixed_in":["1.1.14-2ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15~rc3-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-cluster-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-cts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-nagios-plugins-metadata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pacemaker-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.15-11.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP2","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.15-21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP1","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.13-20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.13-20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 11 SP4","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.12-18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-2ubuntu1.2"}]}],"versions":["1.1.12-0ubuntu2","1.1.12-0ubuntu3","1.1.14~rc4-2ubuntu1","1.1.14-1ubuntu1","1.1.14-1ubuntu2","1.1.14-2ubuntu1","1.1.14-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10+git20130802-1ubuntu2.4"}]}],"versions":["1.1.10+git20130802-1ubuntu1","1.1.10+git20130802-1ubuntu2","1.1.10+git20130802-1ubuntu2.1","1.1.10+git20130802-1ubuntu2.2","1.1.10+git20130802-1ubuntu2.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pacemaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.14-2ubuntu1.2"}]}],"versions":["1.1.12-0ubuntu2","1.1.12-0ubuntu3","1.1.14~rc4-2ubuntu1","1.1.14-1ubuntu1","1.1.14-1ubuntu2","1.1.14-2ubuntu1","1.1.14-2ubuntu1.1"],"bundled":2}],"products":[{"vendor":"clusterlabs","product":"pacemaker"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse_project","product":"leap"},{"vendor":"redhat","product":"enterprise_linux_high_availability"},{"vendor":"redhat","product":"enterprise_linux_resilient_storage"},{"vendor":"suse","product":"linux_enterprise_high_availability"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2578.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-12/msg00077.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/01/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://bugs.clusterlabs.org/show_bug.cgi?id=5269","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/ClusterLabs/pacemaker/commit/5ec24a2642bd0854b884d1a9b51d12371373b410","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/93261","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7797","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gp6f-9wm3-5hr4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7797","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2578","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1240330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1268313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1284069","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287315","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1288929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1304771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1310486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1312094","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1314157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1338623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1361533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1379784","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2578.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7797","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162869-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000743","tags":["report"]},{"url":"https://bugzilla.suse.com/1002767","tags":["report"]},{"url":"https://bugzilla.suse.com/1003565","tags":["report"]},{"url":"https://bugzilla.suse.com/1007433","tags":["report"]},{"url":"https://bugzilla.suse.com/967388","tags":["report"]},{"url":"https://bugzilla.suse.com/986644","tags":["report"]},{"url":"https://bugzilla.suse.com/987348","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7797","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162974-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009076","tags":["report"]},{"url":"https://bugzilla.suse.com/995365","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163162-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/953192","tags":["report"]},{"url":"https://bugzilla.suse.com/970733","tags":["report"]},{"url":"https://bugzilla.suse.com/971129","tags":["report"]},{"url":"https://bugzilla.suse.com/972187","tags":["report"]},{"url":"https://bugzilla.suse.com/974108","tags":["report"]},{"url":"https://bugzilla.suse.com/975079","tags":["report"]},{"url":"https://bugzilla.suse.com/976271","tags":["report"]},{"url":"https://bugzilla.suse.com/976865","tags":["report"]},{"url":"https://bugzilla.suse.com/977258","tags":["report"]},{"url":"https://bugzilla.suse.com/977675","tags":["report"]},{"url":"https://bugzilla.suse.com/977800","tags":["report"]},{"url":"https://bugzilla.suse.com/981489","tags":["report"]},{"url":"https://bugzilla.suse.com/981731","tags":["report"]},{"url":"https://bugzilla.suse.com/986056","tags":["report"]},{"url":"https://bugzilla.suse.com/986201","tags":["report"]},{"url":"https://bugzilla.suse.com/986265","tags":["report"]},{"url":"https://bugzilla.suse.com/986676","tags":["report"]},{"url":"https://bugzilla.suse.com/986931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7797","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3462-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7035","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1867","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-7797","description":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.","status":"published","published":"2017-03-24T15:00:00Z","modified":"2024-08-06T02:04:56.102Z","updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2016-8647","description":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.","status":"published","published":"2017-03-24T15:00:00Z","modified":"2024-08-06T02:04:56Z","updated_at":"2026-11-03T02:22:31.946809Z"}],"ghsa":[{"id":"GHSA-gp6f-9wm3-5hr4","title":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a...","description":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.","status":"published","published":"2022-05-14T02:11:47Z","modified":"2023-02-02T05:05:20Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:52:04.117158Z"}],"nvd":[{"id":"CVE-2016-7797","description":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.","status":"published","published":"2017-03-24T15:59:00.717Z","modified":"2026-06-17T00:53:30.893Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-7797","description":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.","status":"published","published":"2017-03-24T15:59:00.717Z","modified":"2026-10-20T13:19:33.957749939Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-7797","description":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.","status":"published","published":"2017-03-24T15:59:00.717Z","modified":"2026-09-22T07:02:23.778948788Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"RHSA-2016:2578","title":"Red Hat Security Advisory: pacemaker security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:13:07Z","modified":"2026-05-13T10:35:16.209071Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-7797","description":"Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.","status":"published","published":"2017-03-24T00:00:00Z","modified":"2026-04-22T10:59:36.020285Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"openSUSE-SU-2024:10507-1","title":"libpacemaker-devel-1.1.15+git20161104.b6f251a-1.1 on GA media","description":"These are all security issues fixed in the libpacemaker-devel-1.1.15+git20161104.b6f251a-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:26:01.598139Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:2869-1","title":"Security update for pacemaker","description":"\nThis update for pacemaker fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-7797: Notify other clients of a new connection only if the handshake has completed (bsc#967388, bsc#1002767).\n- CVE-2016-7035: Fixed improper IPC guarding in pacemaker (bsc#1007433).\n\nBug fixes:\n- bsc#1003565: crmd: Record pending operations in the CIB before they are performed\n- bsc#1000743: pengine: Do not fence a maintenance node if it shuts down cleanly\n- bsc#987348: ping: Avoid temporary files for fping check\n- bsc#986644: libcrmcommon: report errors consistently when waiting for data on connection\n- bsc#986644: remote: Correctly calculate the remaining timeouts when receiving messages\n","status":"published","published":"2016-11-22T11:05:30Z","modified":"2026-02-04T02:54:19.550199Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2974-1","title":"Security update for pacemaker","description":"\nThis update for pacemaker fixes the following issues:\n\n- remote: Allow cluster and remote LRM API versions to diverge (bsc#1009076)\n- libcrmcommon: fix CVE-2016-7035 (improper IPC guarding) (bsc#1007433)\n- sysconfig: minor tweaks (typo, wording)\n- spec: more robust check for systemd being in use\n- spec: defines instead of some globals + error suppression\n- various: issues discovered via valgrind and coverity\n- attrd_updater: fix usage of HAVE_ATOMIC_ATTRD\n\n- crmd: cl#5185 - Record pending operations in the CIB before they are performed (bsc#1003565)\n- ClusterMon: fix to avoid matching other process with the same PID\n- mcp: improve comments for sysconfig options\n- remove openssl-devel and libselinux-devel as build dependencies\n- tools: crm_standby --version/--help should work without cluster\n- libpengine: only log startup-fencing warning once\n- pacemaker.service: do not mistakenly suggest killing fenced\n- libcrmcommon: report errors consistently when waiting for data on connection (bsc#986644)\n- remote: Correctly calculate the remaining timeouts when receiving messages (bsc#986644)\n- libfencing: report added node ID correctly\n- crm_mon: Do not call setenv with null value\n- pengine: Do not fence a maintenance node if it shuts down cleanly (bsc#1000743)\n- ping: Avoid temporary files for fping check (bsc#987348)\n- all: clarify licensing and copyrights\n- crmd: Resend the shutdown request if the DC forgets\n- ping: Avoid temp files in fping_check  (bsc#987348)\n- crmd: Ensure the R_SHUTDOWN is set whenever we ask the DC to shut us down\n- crmd: clear remote node operation history only when it comes up\n- libcib,libfencing,libtransition: handle memory allocation errors without CRM_CHECK()\n- tools: make crm_mon XML schema handle resources with multiple active\n- pengine: set OCF_RESKEY_CRM_meta_notify_active_* for multistate resources\n- pengine: avoid null dereference in new same-node ordering option\n- lrmd,libcluster: ensure g_hash_table_foreach() is never passed a null table\n- crmd: don't log warning if abort_unless_down() can't find down event\n- lib: Correction of the deletion of the notice registration.\n- stonithd: Correction of the wrong connection process name.\n- crmd: Keep a state of LRMD in the DC node latest.\n- pengine: avoid transition loop for start-then-stop + unfencing\n- libpengine: allow pe_order_same_node option for constraints\n\n- cts: Restart systemd-journald with 'systemctl restart systemd-journald.socket' (bsc#995365)\n- libcrmcommon: properly handle XML comments when comparing v2 patchset diffs\n- crmd: don't abort transitions for CIB comment changes\n- libcrmcommon: log XML comments correctly\n- libcrmcommon: remove extraneous format specifier from log message\n\n- remote: cl#5269 - Notify other clients of a new connection only if the handshake has completed (bsc#967388, bsc#1002767, CVE-2016-7797)\n","status":"published","published":"2016-12-02T10:41:08Z","modified":"2025-05-02T04:05:29.948178Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3162-1","title":"Security update for pacemaker","description":"\nThis update for pacemaker fixes one security issue and several non-security issues.\n\nThe following security issue has been fixed:\n\n- libcrmcommon: Fix improper IPC guarding. (bsc#1007433, CVE-2016-7035)\n\nThe following non-security issues have been fixed:\n\n- Add logrotate to reqs of pacemaker-cli.\n- Add $remote_fs dependencies to the init scripts.\n- all: Clarify licensing and copyrights.\n- attrd,ipc: Prevent possible segfault on exit. (bsc#986056)\n- attrd, libcrmcommon: Validate attrd requests better.\n- attrd_updater: Fix usage of HAVE_ATOMIC_ATTRD.\n- cib/fencing: Set status callback before connecting to cluster. (bsc#974108)\n- ClusterMon: Fix to avoid matching other process with the same PID.\n- crmd: Acknowledge cancellation operations for remote connection resources. (bsc#976865)\n- crmd: Avoid timeout on older peers when cancelling a resource operation.\n- crmd: Record pending operations in the CIB before they are performed. (bsc#1003565)\n- crmd: Clear remote node operation history only when it comes up.\n- crmd: Clear remote node transient attributes on disconnect. (bsc#981489)\n- crmd: Don't abort transitions for CIB comment changes.\n- crmd: Ensure the R_SHUTDOWN is set whenever we ask the DC to shut us down.\n- crmd: Get full action information earlier. (bsc#981731)\n- crmd: Graceful proxy shutdown is now tested. (bsc#981489)\n- crmd: Keep a state of LRMD in the DC node latest.\n- crmd,lrmd,liblrmd: Use defined constants for lrmd IPC operations. (bsc#981489)\n- crmd: Mention that graceful remote shutdowns may cause connection failures. (bsc#981489)\n- crmd/pengine: Handle on-fail=ignore properly. (bsc#981731)\n- crmd/pengine: Implement on-fail=ignore without allow-fail. (bsc#981731)\n- crmd: Remove dead code. (bsc#981731)\n- crmd: Rename action number variable in process_graph_event(). (bsc#981731)\n- crmd: Resend the shutdown request if the DC forgets.\n- crmd: Respect start-failure-is-fatal even for artificially injected events. (bsc#981731)\n- crmd: Set remote flag when gracefully shutting down remote nodes. (bsc#981489)\n- crmd: Set the shutdown transient attribute in response to LRMD_IPC_OP_SHUTDOWN_REQ from remote nodes. (bsc#981489)\n- crmd: Support graceful pacemaker_remote stops. (bsc#981489)\n- crmd: Take start-delay into account for the timeout of the action timer. (bsc#977258)\n- crmd: Use defined constant for magic 'direct nack' RC. (bsc#981731)\n- crmd: Use proper resource agent name when caching metadata.\n- crmd: When node load was reduced, crmd carries out a feasible action.\n- crm_mon: Avoid logging errors for any CIB changes that we don't care about. (bsc#986931)\n- crm_mon: Consistently print ms resource state.\n- crm_mon: Do not call setenv with null value.\n- crm_mon: Do not log errors for the known CIB changes that should be ignored. (bsc#986931)\n- crm_mon: Fix time formatting on x32.\n- cts: Avoid kill usage error if DummySD stop called when already stopped.\n- CTS: Get Reattach test working again and up-to-date. (bsc#953192)\n- cts: Simulate pacemaker_remote failure with kill. (bsc#981489)\n- fencing/fence_legacy: Search capable devices by querying them through 'list' action for cluster-glue stonith \n  agents. (bsc#986265)\n- fencing: Record the last known names of nodes to make sure fencing requested with nodeid works. (bsc#974108)\n- libais,libcluster,libcrmcommon,liblrmd: Don't use %z specifier.\n- libcib,libfencing,libtransition: Handle memory allocation errors without CRM_CHECK().\n- lib: Correction of the deletion of the notice registration.\n- libcrmcommon: Correct directory name in log message.\n- libcrmcommon: Ensure crm_time_t structure is fully initialized by API calls.\n- libcrmcommon: Log XML comments correctly.\n- libcrmcommon: Properly handle XML comments when comparing v2 patchset diffs.\n- libcrmcommon: Really ensure crm_time_t structure is fully initialized by API calls.\n- libcrmcommon: Remove extraneous format specifier from log message.\n- libcrmcommon: Report errors consistently when waiting for data on connection. (bsc#986644)\n- libfencing: Report added node ID correctly.\n- liblrmd: Avoid memory leak when closing or deleting lrmd connections.\n- libpengine: Allow pe_order_same_node option for constraints.\n- libpengine: Log message when stonith disabled, not enabled.\n- libpengine: Only log startup-fencing warning once.\n- libtransition: Potential memory leak if unpacking action fails.\n- lrmd: Handle shutdown a little more cleanly. (bsc#981489)\n- lrmd,libcluster: Ensure g_hash_table_foreach() is never passed a null table.\n- lrmd,liblrmd: Add lrmd IPC operations for requesting and acknowledging shutdown. (bsc#981489)\n- lrmd: Make proxied IPC providers/clients opaque. (bsc#981489)\n- mcp: Improve comments for sysconfig options.\n- pacemaker_remote: Set LSB Provides header to the service name.\n- pacemaker_remote: Support graceful stops. (bsc#981489)\n- PE: Correctly update the dependent actions of un-runnable clones.\n- PE: Honor the shutdown transient attributes for remote nodes. (bsc#981489)\n- pengine: Avoid memory leak when invalid constraint involves set.\n- pengine: Avoid null dereference in new same-node ordering option.\n- pengine: Avoid transition loop for start-then-stop + unfencing.\n- pengine: Avoid use-after-free with location constraint + sets + templates.\n- pengine: Better error handling when unpacking sets in location constraints.\n- pengine: Consider resource failed if any of the configured monitor operations failed. (bsc#972187)\n- pengine: Correction of the record judgment of the failed information.\n- pengine: Do not fence a maintenance node if it shuts down cleanly. (bsc#1000743)\n- pengine: Correctly set the environment variable 'OCF_RESKEY_CRM_meta_timeout' when 'start-delay' is configured. \n  (bsc#977258)\n- pengine: Only set unfencing constraints once.\n- pengine: Organize order of actions for master resources in anti-colocations. (bsc#977800)\n- pengine: Organize order of actions for slave resources in anti-colocations. (bsc#977800)\n- pengine: Properly order stop actions relative to stonith.\n- pengine: Respect asymmetrical ordering when trying to move resources. (bsc#977675)\n- pengine: Set OCF_RESKEY_CRM_meta_notify_active_* for multistate resources.\n- pengine,tools: Display pending resource state by default when it's available. (bsc#986201)\n- ping: Avoid temp files in fping_check. (bsc#987348)\n- ping: Avoid temporary files for fping check. (bsc#987348)\n- ping: Log sensible error when /tmp is full. (bsc#987348)\n- ping resource: Use fping6 for IPv6 hosts. (bsc#976271)\n- RA/SysInfo: Reset the node attribute '#health_disk' to 'green' when there's sufficient free disk. (bsc#975079)\n- remote: Allow cluster and remote LRM API versions to diverge. (bsc#1009076)\n- remote: Correctly calculate the remaining timeouts when receiving messages. (bsc#986644)\n- resources: Use OCF version tagging correctly.\n- services: Correctly clean up service actions for non-dbus case.\n- spec: fence_pcmk only eligible for Pacemaker+CMAN.\n- stonithd: Correction of the wrong connection process name.\n- sysconfig: Minor tweaks (typo, wording).\n- tools: Avoid memory leaks in crm_resource --restart.\n- tools: Avoid memory leak when crm_mon unpacks constraints.\n- tools: Correctly count starting resources when doing crm_resource --restart.\n- tools: crm_resource -T option should not be hidden anymore.\n- tools: crm_standby --version/--help should work without cluster.\n- tools: Do not send command lines to syslog. (bsc#986676)\n- tools: Do not assume all resources restart on same node with crm_resource --restart.\n- tools: Don't require node to be known to crm_resource when deleting attribute.\n- tools: Properly handle crm_resource --restart with a resource in a group.\n- tools: Remember any existing target-role when doing crm_resource --restart.\n- various: Issues discovered via valgrind and coverity.\n\nAdditionally, the following references have been added to the changelog:\n\nbsc#970733, fate#318381, bsc#1002767, CVE-2016-7797, bsc#971129\n","status":"published","published":"2016-12-15T13:52:25Z","modified":"2026-02-04T02:31:02.203843Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3462-1","title":"pacemaker vulnerabilities","description":"Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled\nthe IPC interface. A local attacker could possibly use this issue to\nexecute arbitrary code with root privileges. (CVE-2016-7035)\n\nAlain Moulle discovered that Pacemaker incorrectly handled authentication.\nA remote attacker could possibly use this issue to shut down connections,\nleading to a denial of service. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2016-7797)\n","status":"published","published":"2017-10-24T13:27:05Z","modified":"2026-04-22T09:40:34.348896Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}