Red Hat alert RHSA-2021:4142-01 (pcs)
| From: | "Security announcements for all Red Hat products and services." <rhsa-announce@redhat.com> | |
| To: | rhsa-announce@redhat.com | |
| Subject: | [RHSA-2021:4142-02] Low: pcs security, bug fix, and enhancement update | |
| Date: | Tue, 09 Nov 2021 20:49:27 -0000 | |
| Message-ID: | <163649096768.15.17706793136585048747@sdengine-celery-fast-19-5mfnq> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Low: pcs security, bug fix, and enhancement update Advisory ID: RHSA-2021:4142-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4142 Issue date: 2021-11-09 CVE Names: CVE-2020-7656 CVE-2020-11023 ===================================================================== 1. Summary: An update for pcs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux HighAvailability (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux ResilientStorage (v. 8) - ppc64le, s390x, x86_64 3. Description: The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. The following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594) Security Fix(es): * jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656) * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1290830 - [RFE] pcs command is missing a way to retrieve the status of a single resource 1432097 - pcs status nodes shows incomplete information when both standby and maintenance modes are set for a node 1678273 - Moving the last resource from a group may result in an invalid CIB 1690419 - Improve guest node error message when pacemaker_remote is running 1720221 - [RFE] Add support for corosync option totem.block_unlisted_ips 1759995 - [RFE] Need ability to add/remove storage devices with scsi fencing 1841019 - [TechPreview Exit][RFE] Add a 'local' cluster setup command 1850004 - CVE-2020-11023 jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods 1850119 - CVE-2020-7656 jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces 1854238 - Labeling and Confirmation Dialog for UI Elements start(on)/stop(off)/restart(reboot) 1872378 - [RFE] Provide a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources 1885293 - Support new role terminology in pacemaker 2.1 1885302 - reflect changes in crm_mon --as-xml 1896458 - Default rules with node attributes expressions can be created but are not in effect 1909901 - [RFE] Add --quiet flag to pcs resource disable --safe to only show error messages instead of full output 1922996 - New web UI - add more functionalities to the cluster management 1927384 - New web UI - clone and group settings are not in effect when creating new resource 1927394 - New web UI - cleanup of resource and fence device doesn't work 1930886 - Update help/man pcs to include clone id as an option in 'pcs resource unclone' parameters 1935594 - pcs rebase bz for 8.5 1984901 - sbd can't be enabled via pcs with stopped cluster 1991654 - update-scsi-devices command unfence a node without quorum 1992668 - [RFE] Provide add/remove syntax for command `pcs stonith update-scsi-devices` 1998454 - nginx resource can't be created 6. Package List: Red Hat Enterprise Linux HighAvailability (v. 8): Source: pcs-0.10.10-4.el8.src.rpm aarch64: pcs-0.10.10-4.el8.aarch64.rpm pcs-snmp-0.10.10-4.el8.aarch64.rpm ppc64le: pcs-0.10.10-4.el8.ppc64le.rpm pcs-snmp-0.10.10-4.el8.ppc64le.rpm s390x: pcs-0.10.10-4.el8.s390x.rpm pcs-snmp-0.10.10-4.el8.s390x.rpm x86_64: pcs-0.10.10-4.el8.x86_64.rpm pcs-snmp-0.10.10-4.el8.x86_64.rpm Red Hat Enterprise Linux ResilientStorage (v. 8): Source: pcs-0.10.10-4.el8.src.rpm ppc64le: pcs-0.10.10-4.el8.ppc64le.rpm pcs-snmp-0.10.10-4.el8.ppc64le.rpm s390x: pcs-0.10.10-4.el8.s390x.rpm pcs-snmp-0.10.10-4.el8.s390x.rpm x86_64: pcs-0.10.10-4.el8.x86_64.rpm pcs-snmp-0.10.10-4.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-7656 https://access.redhat.com/security/cve/CVE-2020-11023 https://access.redhat.com/security/updates/classification... https://access.redhat.com/documentation/en-us/red_hat_ent... 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYre19zjgjWX9erEAQhbXQ//fpAgz6azVHUidymjlIJ/d65HrM9a+hwU 2c7zeYGKSBUpxWTIo0LzwVn7oQTJpmPdbDZzedS14e3ZijQcMjwImHI6yzlAkDxl hycmu4PakPBE3s7tmOIaUybc8opHPDLGbyBvohe7O3U+5oTvUBWhI35jeX3CTjsE RQFEwII4uqiTJ5pOnVN0TFfkooz5pY6oArGPg3kFb+17T9C0TWXxB/Nbyqg+yLJ3 krjB/aFgcm2RsP+IFB9Rg6RFaovKozXhckhJ+UxC2sQWKehnU8bhLVCf+l5psM6l jnQtZi2LQOXlB8UQsjK3PWtyxVF7/MFmfLK7VX3RStCxukLKDIGc99tYl4zjgrJQ LshNnrn6Lz6iWiMFPFnwDhOAbey5LUrpygQUgVU1t4Mhtlpu5FTPGxiZkSVdPPUe Kg/VCDkxPMVO6Mhnjg6axWYiv3WmvM3DLTL0alqjyShe6BW2E/BB8trt9eaCpoe/ EtDBmrBKwLyK5LnToeLK0GL+HDGQDUjL0eWRNKJox8PVtFEtSkyn7I8jaOVeyTIc F9kOxECcY4tQBFegYaDXCIIBAGJda4eyzZR95zzwRWdl8AxuffV8n7enKfShMeqY L1HtkJq3Twced5fqhHRhqwKHEzWl3nKqTz8/gt5OjjLKNZ0M62oTeUjR918+k7+U OPYd9garVDY= =fv9r -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce