Ubuntu alert USN-8170-1 (corosync)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8170-1] Corosync vulnerabilities
Date:
             
 
Mon, 13 Apr 2026 17:49:16 +0000
Message-ID:
             
 
<E1wCLPQ-0008M7-AL@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8170-1
April 13, 2026

corosync vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in Corosync.

Software Description:
- corosync: cluster engine daemon and utilities

Details:

It was discovered that Corosync incorrectly handled the membership commit
token validity check. A remote attacker could use this issue to cause
Corosync to crash, resulting in a denial of service, or to possibly obtain
a small quantity of sensitive information. (CVE-2026-35091)

It was discovered that Corosync incorrectly handled join message
validation. A remote attacker could possibly use this issue to cause
Corosync to crash, resulting in a denial of service. (CVE-2026-35092)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  corosync                        3.1.9-2ubuntu1.1

Ubuntu 24.04 LTS
  corosync                        3.1.7-1ubuntu3.2

Ubuntu 22.04 LTS
  corosync                        3.1.6-1ubuntu1.2

After a standard system update you need to restart Corosync to make all the
necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8170-1
  CVE-2026-35091, CVE-2026-35092

Package Information:
  https://launchpad.net/ubuntu/+source/corosync/3.1.9-2ubun...
  https://launchpad.net/ubuntu/+source/corosync/3.1.7-1ubun...
  https://launchpad.net/ubuntu/+source/corosync/3.1.6-1ubun...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmndLGsACgkQcpJm3tlz
hgG+Xg//dS7Pj8TmKCL6k3iK38P3z2674UsnW2forPSirdLX2Jeef2SXIp0wpy/g
rxTDiI5d8J+XCKLJjveCC/LDjS1AG26PFvrnAXIVY821s5hEqEpsaBZjEXgQG9xg
ERlg+VPtytFZutp4XlsSu42SD0QPWoyE/oC+5vs54joegZgKy2UsCOwV5jicGZVn
DjQs9rV9ioKXYTTemZPoI1k/6ecULRn3oW9EOlZ14lgT2PpvXooDvzgzA4+ma42R
iZSrQlHFmUnNidsjX6yJO/Oo/nmK5YMQsu6/twJGj/cQm7U9Wwo3MuwwR5ixB2w7
UyhA9lePzcdzzntX8yrPBe2z0tQ37ZKZ8oP390dJJbvjMbYrAq29X8yXWWF7MbpT
yxAsd8aVyEOaL1O3XOKbI/f3tEl4iIdGuEHvfgLwLSyRQNSJkPvHbTO34CWRul83
zxnpGKPx5mBLvfZoTjEhoKV5iAPKKGcMLeBbbPRq4jI5YTkRIZdJlswe141VhLRB
RGuhA/MlTfSQVnhcdrAGoOOkZL5/p306Rmoa1wl6F7spNG3sERaEtldqrhRmZZ/F
voQa3gnoERA5wZfTtfJCAmZM3dn43+ZSRNl0jwViNMEmX3RrK+f5Xvcfgkev1UUz
I8cEKOiFpJGK8F+EIaoBdsDG1Xrgqb771tkb9ntpuiAtAjZ2omM=
=bmjT
-----END PGP SIGNATURE-----