Описание
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
Отчет
This is classified as an Important flaw. An unauthenticated remote attacker can trigger a denial of service in Pacemaker's CIB remote listener by sending a crafted compressed message. This vulnerability exists before authentication, allowing an attacker with network access to a configured remote-port or remote-tls-port to cause the service to crash.
Меры по смягчению последствий
Disable the Pacemaker CIB remote listener if it is not actively used. If the listener is required, restrict network access to trusted hosts by configuring firewall rules to limit inbound connections to the remote-port or remote-tls-port. These actions reduce the attack surface by limiting unauthenticated network exposure to the vulnerable component. A restart of the Pacemaker service may be necessary for these changes to be fully applied.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | pacemaker | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected | ||
| Red Hat Enterprise Linux 10 | pacemaker | Fixed | RHSA-2026:40833 | 16.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | pacemaker | Fixed | RHSA-2026:41041 | 16.07.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | pacemaker | Fixed | RHSA-2026:43606 | 22.07.2026 |
| Red Hat Enterprise Linux 8 | pacemaker | Fixed | RHSA-2026:39322 | 14.07.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | pacemaker | Fixed | RHSA-2026:42075 | 20.07.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | pacemaker | Fixed | RHSA-2026:42075 | 20.07.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | pacemaker | Fixed | RHSA-2026:42076 | 20.07.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | pacemaker | Fixed | RHSA-2026:42076 | 20.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
A flaw was found in Pacemaker. An unauthenticated remote attacker can ...
EPSS
8.6 High
CVSS3