Security update for pacemaker SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:2965-1 Final 1 1 2016-12-01T13:12:27Z current 2016-12-01T13:12:27Z 2016-12-01T13:12:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pacemaker This update for pacemaker fixes the following issues: Security issues fixed: - CVE-2016-7797: Notify other clients of a new connection only if the handshake has completed (bsc#967388, bsc#1002767). - CVE-2016-7035: Fixed improper IPC guarding in pacemaker (bsc#1007433). Bug fixes: - bsc#1003565: crmd: Record pending operations in the CIB before they are performed - bsc#1000743: pengine: Do not fence a maintenance node if it shuts down cleanly - bsc#987348: ping: Avoid temporary files for fping check - bsc#986644: libcrmcommon: report errors consistently when waiting for data on connection - bsc#986644: remote: Correctly calculate the remaining timeouts when receiving messages This update was imported from the SUSE:SLE-12-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html E-Mail link for openSUSE-SU-2016:2965-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 libpacemaker-devel-1.1.15-5.1 libpacemaker3-1.1.15-5.1 pacemaker-1.1.15-5.1 pacemaker-cli-1.1.15-5.1 pacemaker-cts-1.1.15-5.1 pacemaker-remote-1.1.15-5.1 libpacemaker-devel-1.1.15-5.1 as a component of openSUSE Leap 42.2 libpacemaker3-1.1.15-5.1 as a component of openSUSE Leap 42.2 pacemaker-1.1.15-5.1 as a component of openSUSE Leap 42.2 pacemaker-cli-1.1.15-5.1 as a component of openSUSE Leap 42.2 pacemaker-cts-1.1.15-5.1 as a component of openSUSE Leap 42.2 pacemaker-remote-1.1.15-5.1 as a component of openSUSE Leap 42.2 An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine. CVE-2016-7035 openSUSE Leap 42.2:libpacemaker-devel-1.1.15-5.1 openSUSE Leap 42.2:libpacemaker3-1.1.15-5.1 openSUSE Leap 42.2:pacemaker-1.1.15-5.1 openSUSE Leap 42.2:pacemaker-cli-1.1.15-5.1 openSUSE Leap 42.2:pacemaker-cts-1.1.15-5.1 openSUSE Leap 42.2:pacemaker-remote-1.1.15-5.1 moderate 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html https://www.suse.com/security/cve/CVE-2016-7035.html CVE-2016-7035 https://bugzilla.suse.com/1007433 SUSE Bug 1007433 Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection. CVE-2016-7797 openSUSE Leap 42.2:libpacemaker-devel-1.1.15-5.1 openSUSE Leap 42.2:libpacemaker3-1.1.15-5.1 openSUSE Leap 42.2:pacemaker-1.1.15-5.1 openSUSE Leap 42.2:pacemaker-cli-1.1.15-5.1 openSUSE Leap 42.2:pacemaker-cts-1.1.15-5.1 openSUSE Leap 42.2:pacemaker-remote-1.1.15-5.1 moderate 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html https://www.suse.com/security/cve/CVE-2016-7797.html CVE-2016-7797 https://bugzilla.suse.com/1002767 SUSE Bug 1002767