CVE-2010-2496: stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the…

PriorityP424medium5.5CVSS 3.1

AVLACLPRLUINSUCHINAN

EPSS

0.22%

13.1th percentile

stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
clusterlabs	cluster_glue	< 1.0.6	1.0.6
clusterlabs	pacemaker	< 1.1.3	1.1.3
clusterlabs	pacemaker	>= 0 < 1.1.13-1	1.1.13-1
clusterlabs	pacemaker	>= 0 < 1.1.13-1	1.1.13-1
clusterlabs	pacemaker	>= 0 < 1.1.13-1	1.1.13-1
clusterlabs	pacemaker	>= 0 < 1.1.13-1	1.1.13-1
debian	cluster-glue	< cluster-glue 1.0.6-1 (bookworm)	cluster-glue 1.0.6-1 (bookworm)
debian	pacemaker	< cluster-glue 1.0.6-1 (bookworm)	cluster-glue 1.0.6-1 (bookworm)

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.