Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:2719-1

Опубликовано: 01 июл. 2026
Источник: suse-cvrf

Описание

Security update for pacemaker

This update for pacemaker fixes the following issues:

  • CVE-2026-10649: Fixed denial-of-service via integer overflow in remote message decompression (bsc#1268381).

Changes for pacemaker:

  • Update to version 2.1.10+20260618.4bca25e3c1:

    • libcrmcommon: Add additional checks to pcmk__remote_message_xml. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)
    • libcib: Remove an unnecessary coverity suppression. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)
    • libcrmcommon: Fix an integer overflow in pcmk__remote_send_xml. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)
    • libcrmcommon: Limit the max size of a remote message. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)
    • libcrmcommon: Fix integer overflow in remote message code. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)
    • libcrmcommon: Add sanity checks to localized_remote_header. (Crh#2462817, gh#ClusterLabs/pacemaker#4133)
    • libcrmcommon: Fix a glib logging build error
    • libcrmcommon, libpacemaker: Don't assign const char * to char *

Список пакетов

SUSE Linux Enterprise High Availability Extension 15 SP7
pacemaker-2.1.10+20260618.4bca25e3c1-150700.3.6.1
pacemaker-cli-2.1.10+20260618.4bca25e3c1-150700.3.6.1
pacemaker-cts-2.1.10+20260618.4bca25e3c1-150700.3.6.1
pacemaker-devel-2.1.10+20260618.4bca25e3c1-150700.3.6.1
pacemaker-libs-2.1.10+20260618.4bca25e3c1-150700.3.6.1
pacemaker-remote-2.1.10+20260618.4bca25e3c1-150700.3.6.1
pacemaker-schemas-2.1.10+20260618.4bca25e3c1-150700.3.6.1
python3-pacemaker-2.1.10+20260618.4bca25e3c1-150700.3.6.1

Ссылки

Описание

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.

Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP7:pacemaker-2.1.10+20260618.4bca25e3c1-150700.3.6.1
SUSE Linux Enterprise High Availability Extension 15 SP7:pacemaker-cli-2.1.10+20260618.4bca25e3c1-150700.3.6.1
SUSE Linux Enterprise High Availability Extension 15 SP7:pacemaker-cts-2.1.10+20260618.4bca25e3c1-150700.3.6.1
SUSE Linux Enterprise High Availability Extension 15 SP7:pacemaker-devel-2.1.10+20260618.4bca25e3c1-150700.3.6.1
Ссылки