CVE-2018-16877

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
Affected Products (NVD)
VendorProductVersion
clusterlabspacemaker
𝑥
≤ 2.0.0
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
canonicalubuntu_linux
19.04
debiandebian_linux
9.0
opensuseleap
15.0
opensuseleap
42.3
redhatenterprise_linux
8.0
redhatenterprise_linux_eus
8.1
redhatenterprise_linux_eus
8.2
redhatenterprise_linux_eus
8.4
redhatenterprise_linux_eus
8.6
redhatenterprise_linux_server_aus
8.2
redhatenterprise_linux_server_aus
8.4
redhatenterprise_linux_server_aus
8.6
redhatenterprise_linux_server_tus
8.2
redhatenterprise_linux_server_tus
8.4
redhatenterprise_linux_server_tus
8.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pacemaker
bookworm
2.1.5-1+deb12u1
fixed
bullseye
2.0.5-2
fixed
sid
2.1.8-1
fixed
trixie
2.1.8-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pacemaker
bionic
Fixed 1.1.18-0ubuntu1.1
released
cosmic
Fixed 1.1.18-2ubuntu1.18.10.1
released
disco
Fixed 1.1.18-2ubuntu1.19.04.1
released
trusty
dne
xenial
Fixed 1.1.14-2ubuntu1.6
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
pacemaker
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-cli
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-cluster-libs
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-cts
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-doc
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-libs
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-libs-devel
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-nagios-plugins-metadata
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-remote
RHEL 7
0:1.1.19-8.el7_6.5
fixed
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
pacemaker-schemas
RHEL 8
0:2.0.1-4.el8_0.3
fixed
RHEL 8.0 E4S
0:2.0.1-4.el8_0.3
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00034.html
http://www.securityfocus.com/bid/108042
https://access.redhat.com/errata/RHSA-2019:1278
https://access.redhat.com/errata/RHSA-2019:1279
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16877
https://github.com/ClusterLabs/pacemaker/pull/1749
https://lists.debian.org/debian-lts-announce/2021/01/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GCWFO7GL6MBU6C4BGFO3P6L77DIBBF3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FY4M4RMIG2POKC6OOFQODGKPRYXHET2F/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HR6QUYGML735EI3HEEHYRDW7EG73BUH2/
https://security.gentoo.org/glsa/202309-09
https://usn.ubuntu.com/3952-1/
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00034.html
http://www.securityfocus.com/bid/108042
https://access.redhat.com/errata/RHSA-2019:1278
https://access.redhat.com/errata/RHSA-2019:1279
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16877
https://github.com/ClusterLabs/pacemaker/pull/1749
https://lists.debian.org/debian-lts-announce/2021/01/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GCWFO7GL6MBU6C4BGFO3P6L77DIBBF3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FY4M4RMIG2POKC6OOFQODGKPRYXHET2F/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HR6QUYGML735EI3HEEHYRDW7EG73BUH2/
https://security.gentoo.org/glsa/202309-09
https://usn.ubuntu.com/3952-1/