Red Hat Security Advisory: pcs security update

The pcs packages in Red Hat Enterprise Linux 9.2 include a security fix for a denial-of-service vulnerability in the python-tornado library's HTTP cookie parsing functionality, identified as CVE-2024-52804. This vulnerability could potentially be exploited to cause a denial of service. The update is provided as part of Red Hat's security advisory RHSA-2025:3108 and affects multiple variants of Red Hat Enterprise Linux 9.2 with Extended Update Support and other update services. The advisory references CVE-2024-14029 as well, but the primary fix is for the tornado vulnerability. Red Hat has released updated packages to remediate this issue.

The vulnerability allows an attacker to cause a denial of service via malformed HTTP cookies processed by the python-tornado library used by pcs. This could disrupt the availability of the pcs service, which is critical for managing cluster resources in Pacemaker and Corosync environments. The issue is rated as important by Red Hat, indicating a significant impact on service availability but not necessarily leading to remote code execution or data compromise.

Red Hat has released updated pcs packages for Red Hat Enterprise Linux 9.2 variants that include the fix for CVE-2024-52804. Users should apply the update as described in Red Hat advisory RHSA-2025:3108 and the referenced article https://access.redhat.com/articles/11258 to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official update.