p PatchFirst

PatchFirst · Latest vulnerabilities

pcs vulnerabilities

Vulnerabilities published for pcs in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 22

  1. ALSA-2026:84798

    Not ratedFix available

    Important: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields (CVE-2026-82397) * python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVE-2024-14029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.10.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. ALSA-2026:8093

    Not ratedFix available

    Moderate: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.9.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. ALSA-2026:0930

    Not ratedFix available

    Moderate: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725) * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.8.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. ALSA-2025:19719

    Not ratedFix available

    Important: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830) * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770) * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771) * rack: Rack memory exhaustion denial of service (CVE-2025-61772) * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to m

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.7.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. ALSA-2025:11047

    Not ratedFix available

    Moderate: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.6.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. ALSA-2025:8254

    Not ratedFix available

    Important: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727) * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.5.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. ALSA-2025:2872

    Not ratedFix available

    Important: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.4.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. ALSA-2024:10987

    Not ratedFix available

    Moderate: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * sinatra: Open Redirect Vulnerability in Sinatra via X-Forwarded-Host Header (CVE-2024-21510) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.3.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. ALSA-2024:6670

    Not ratedFix available

    Moderate: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rexml: rubygem-rexml: DoS when parsing an XML having many specific characters such as whitespace character, >] and ]> (CVE-2024-41123) * rexml: DoS vulnerability in REXML (CVE-2024-41946) * rexml: DoS vulnerability in REXML (CVE-2024-43398) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.2.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. ALSA-2024:5338

    Not ratedFix available

    Low: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.18-2.el8_10.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. ALSA-2024:2953

    Not ratedFix available

    Moderate: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126) * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141) * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in

    pcsOperating systems
    • Update to 0.10.18-2.el8_10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. ALSA-2023:3082

    Not ratedFix available

    Moderate: pcs security and bug fix update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530) * rubygem-rack: denial of service in header parsing (CVE-2023-27539) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180700) * Need a way to add a scsi fencing device to a cluster without r

    pcsOperating systems
    • Update to 0.10.15-4.el8_8.1.alma
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. ALSA-2023:0855

    Not ratedFix available

    Moderate: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * sinatra: Reflected File Download attack (CVE-2022-45442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.14-5.el8_7.2.alma
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. ALSA-2022:7447

    Not ratedFix available

    Moderate: pcs security, bug fix, and enhancement update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * pcs: improper authentication via PAM (CVE-2022-1049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

    pcsOperating systems
    • Update to 0.10.14-5.el8.alma
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. ALSA-2022:6314

    Not ratedFix available

    Important: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * pcs: obtaining an authentication token for hacluster user could lead to privilege escalation (CVE-2022-2735) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.12-6.el8_6.2.alma
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. ALSA-2022:4661

    Not ratedFix available

    Important: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * sinatra: path traversal possible outside of public_dir when serving static files (CVE-2022-29970) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcsOperating systems
    • Update to 0.10.12-6.el8.alma
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. ALBA-2022:0881

    Not ratedFix available

    pcs bug fix and enhancement update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Bug Fix(es) and Enhancement(s): * Enabling sbd before starting the cluster sets an incorrect `validate-with` value in /var/lib/pacemaker/cib/cib.xml (BZ#2042433)

    pcsOperating systems
    • Update to 0.10.10-4.el8_5.1.alma
    Published Updated
    Source advisory ↗

  19. ALSA-2021:4142

    Not ratedFix available

    Low: pcs security, bug fix, and enhancement update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. The following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594) Security Fix(es): * jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656) * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For

    pcsOperating systems
    • Update to 0.10.10-4.el8.alma
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. ALEA-2021:1737

    Not ratedFix available

    pcs bug fix and enhancement update

    For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

    pcsOperating systems
    • Update to 0.10.8-1.el8.alma
    Published Updated
    Source advisory ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →