Red Hat Security Advisory: pcs security update

The pcs packages provide command-line configuration for Pacemaker and Corosync. A security fix has been issued to address a denial-of-service vulnerability in the python-tornado library's HTTP cookie parsing (CVE-2024-52804). This vulnerability could potentially be exploited to cause a denial of service. The update is available for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants across multiple architectures including x86_64, ppc64le, s390x, and aarch64. The advisory references CVE-2024-14029 and CVE-2024-52804 and directs users to Red Hat's update article for remediation steps.

The vulnerability allows for a denial-of-service condition via HTTP cookie parsing in the python-tornado component used by pcs. This could disrupt the availability of services relying on pcs for cluster configuration management. The issue is rated as Important by Red Hat, indicating a high impact on system availability but no direct indication of code execution or data compromise.

Red Hat has released an official security update for pcs packages in Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. Users should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the vulnerability. Since this is an official fix, applying the update fully mitigates the issue.