CVE-2018-16877

Severity
7.8HIGH
EPSS
0.0%
top 88.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 18
Latest updateMay 24

Description

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

Debianpacemaker< 2.0.1-3+3
Ubuntupacemaker< 1.1.14-2ubuntu1.6+1
CVEListV5clusterlabs/pacemakeraffects up to and including Pacemaker-2.0.0
NVDopensuse/leap15.0, 42.3+1

Also affects: Debian Linux 9.0, Fedora 28, 29, 30, Ubuntu Linux 16.04, 18.04, 18.10, 19.04, Enterprise Linux 8.0, 8.1, 8.2, 8.4, 8.6

Patches

🔴Vulnerability Details

4
GHSA
GHSA-5jf9-5f49-xqr5: A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 22022-05-24
OSV
pacemaker vulnerabilities2019-04-23
OSV
CVE-2018-16877: A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 22019-04-18
CVEList
CVE-2018-16877: A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 22019-04-18

📋Vendor Advisories

3
Ubuntu
Pacemaker vulnerabilities2019-04-23
Red Hat
pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc2019-04-17
Debian
CVE-2018-16877: pacemaker - A flaw was found in the way pacemaker's client-server authentication was impleme...2018

💬Community

5
Bugzilla
CVE-2018-16877 pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc [openstack-rdo]2019-05-04
Bugzilla
CVE-2018-16877 CVE-2018-16878 CVE-2019-3885 pacemaker: various flaws [fedora-all]2019-04-17
Bugzilla
CVE-2019-3885 pacemaker: Information disclosure through use-after-free2019-04-01
Bugzilla
CVE-2018-16878 pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS2018-12-10
Bugzilla
CVE-2018-16877 pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc2018-11-22
CVE-2018-16877 (HIGH CVSS 7.8) | A flaw was found in the way pacemak | cvebase.io