Red Hat Security Advisory: pcs security update

The pcs packages provide command-line configuration for Pacemaker and Corosync. A security fix has been issued to address a denial-of-service vulnerability in the python-tornado library used by pcs, specifically involving HTTP cookie parsing (CVE-2024-52804). Red Hat has released an update for Red Hat Enterprise Linux 9 variants to remediate this issue. The advisory references CVE-2024-14029 and CVE-2024-52804 and provides details on affected products and update instructions.

The vulnerability allows an attacker to cause a denial-of-service condition via malformed HTTP cookies processed by the python-tornado component. This could disrupt the availability of services relying on pcs for configuration of cluster management utilities. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for the pcs package in Red Hat Enterprise Linux 9 variants that addresses this vulnerability. Users should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issue. Since an official fix is available, applying the update is the recommended mitigation.