CVE-2010-2496
Medium
Description
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
SeverityMedium
CVSS5.5
Exploit probability—
ProductClusterlabs Cluster Glue
PublishedOct 18, 2021
First seenOct 18, 2021
How to fix
Update
- clusterlabs cluster_glue1.0.6 or later
- clusterlabs pacemaker1.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| clusterlabs cluster_glue | v < 1.0.6 | 1.0.6 |
| clusterlabs pacemaker | v < 1.1.3 | 1.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.