The pcs packages in Red Hat Enterprise Linux 8, which configure Pacemaker and Corosync, are affected by three DoS vulnerabilities in the rubygem-rexml XML parser (CVE-2024-41123, CVE-2024-41946, CVE-2024-43398). These vulnerabilities occur when parsing XML containing many specific characters such as whitespace, >], and ]>, leading to denial of service. Red Hat has released updated pcs packages to fix these issues across multiple architectures and extended life cycle variants of RHEL 8. No CVSS scores are provided in the advisory, but the impact is rated moderate by Red Hat Product Security.

Successful exploitation of these vulnerabilities can cause denial of service by exhausting resources during XML parsing in pcs, potentially disrupting configuration management of cluster services (Pacemaker and Corosync). There is no indication of code execution or data compromise. No known exploits in the wild have been reported.

Red Hat has released updated pcs packages that address these DoS vulnerabilities. Users should apply the security update RHSA-2024:6670 for Red Hat Enterprise Linux 8 and its extended life cycle variants to remediate the issues. Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigations are indicated or required beyond applying the official patch.