Threat database

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830) * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770) * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771) * rack: Rack memory exhaustion denial of service (CVE-2025-61772) * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A security update for the pcs packages in Red Hat Enterprise Linux 9.2 addresses a denial-of-service vulnerability in the python-tornado component related to HTTP cookie parsing (CVE-2024-52804). The pcs packages provide command-line configuration for Pacemaker and Corosync utilities. This issue has been rated as important by Red Hat Product Security. The update is available for multiple Red Hat Enterprise Linux 9.2 variants including High Availability and Resilient Storage on various architectures.

CVE-2024-52804 is a denial-of-service vulnerability in the Tornado Python web framework affecting versions prior to 6.4.2. The flaw is due to the HTTP cookie parsing algorithm exhibiting quadratic complexity when processing certain malicious cookie headers, leading to excessive CPU usage and blocking the event loop thread. This results in a denial of service. A patch is available to address this issue.

A moderate severity open redirect vulnerability (CVE-2024-21510) exists in the pcs packages used for configuring Pacemaker and Corosync utilities on Red Hat Enterprise Linux 8. The vulnerability is due to improper handling of the X-Forwarded-Host header in the Sinatra framework. Red Hat has released security updates to address this issue in multiple variants of Red Hat Enterprise Linux 8 High Availability and Resilient Storage products.

Multiple denial-of-service (DoS) vulnerabilities have been identified in the rubygem-rexml library used by the pcs packages, which provide command-line configuration for Pacemaker and Corosync utilities in Red Hat Enterprise Linux 8. These vulnerabilities involve parsing XML with many specific characters, potentially causing service disruption. Red Hat has released security updates addressing these issues for various Red Hat Enterprise Linux 8 High Availability and Resilient Storage variants.

A low severity vulnerability (CVE-2024-35176) affects the pcs packages used for command-line configuration of Pacemaker and Corosync utilities in Red Hat Enterprise Linux 8. The issue involves a denial of service (DoS) caused by the REXML parser when processing XML attributes containing many '<' characters. Red Hat has released an update to address this vulnerability in multiple Red Hat Enterprise Linux 8 variants, including High Availability and Resilient Storage editions across various architectures. No known exploits are reported in the wild. The update is available and should be applied to affected systems.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126) * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141) * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.