Clusterlabs vulnerabilitiesNone on the known-exploited list.
Clusterlabs has 27 published vulnerabilities across 9 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Pacemaker, with 10. If you run Clusterlabs software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Clusterlabs products have the most vulnerabilities?
Pacemaker leads with 10 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Clusterlabs vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Clusterlabs's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Clusterlabs flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 5.6%CVE-2020-35458Critical
An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x.
- 3.3%CVE-2016-7797High
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
- 3.0%CVE-2015-1867High
Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
- 2.6%CVE-2013-0281Medium
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause...
- 2.3%CVE-2016-0721High
Session fixation vulnerability in pcsd in pcs before 0.9.157.
- 2.2%CVE-2019-10153Medium
A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception.
- 2.0%CVE-2022-1049High
A flaw was found in the Pacemaker configuration tool (pcs).
- 1.9%CVE-2018-1086High
pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass.
- 1.9%CVE-2019-3885High
A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs.
- 1.9%CVE-2020-25654High
An ACL bypass flaw was found in pacemaker.
All Clusterlabs products we track.
9 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Pacemakerpacemaker10 vulnerabilities50 versions
- Pcspcs6 vulnerabilities164 versions
- Boothbooth2 vulnerabilities9 versions
- Fence-Agentsfence-agents2 vulnerabilities57 versions
- Hawkhawk2 vulnerabilities29 versions
- Libqblibqb2 vulnerabilities35 versions
- Pacemaker Command Line Interfacepacemaker_command_line_interface2 vulnerabilities151 versions
- Cluster Gluecluster_glue1 vulnerability12 versions
- Crmshcrmsh1 vulnerability35 versions
Running Clusterlabs? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.
- Matched to
- Hawk on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 27 published vulnerabilities across 9 products and 542 versions from Clusterlabs.
None of Clusterlabs's vulnerabilities is on the list of flaws known to be exploited today.
Pacemaker, with 10 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Clusterlabs products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.