ByteOS Network

NVD Vulnerability Details :

CVE-2010-2496

Analyzed

Source-secalert@redhat.com

Published At-18 Oct, 2021 | 13:15

Updated At-21 Oct, 2021 | 22:49

stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 2.1

Base severity: LOW

Vector:

AV:L/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

clusterlabs>>cluster_glue>>Versions before 1.0.6(exclusive)

cpe:2.3:a:clusterlabs:cluster_glue:*:*:*:*:*:*:*:*

clusterlabs>>pacemaker>>Versions before 1.1.3(exclusive)

cpe:2.3:a:clusterlabs:pacemaker:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-287	Primary	nvd@nist.gov

CWE ID: CWE-287

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2010-2496	secalert@redhat.com	Issue Tracking Mailing List Patch Third Party Advisory

Hyperlink: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2010-2496

Source: secalert@redhat.com

Resource:

Issue Tracking

Mailing List

Patch

Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History