Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2018-16877: Pacemaker up to 2.0.0 allows local privilege escalation
CVE-2018-16877 · published 7 years ago
Summary
The Pacemaker clustering software in versions up to 2.0.0 can be tricked by a local user to gain higher system privileges, especially when combined with other inter‑process communication weaknesses. This affects Ubuntu, Fedora, Debian, and openSUSE Leap systems that include Pacemaker. Apply the latest Pacemaker updates or upgrade to a newer version to block the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| clusterlabs | pacemaker |
<= 2.0.0 cpe:2.3:a:clusterlabs:pacemaker:*:*:*:*:*:*:*:* |
| canonical | ubuntu_linux |
16.04 18.04 18.10 19.04 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
| fedoraproject | fedora |
28 29 30 cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* |
| debian | debian_linux |
9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| opensuse | leap |
15.0 42.3 cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux |
8.0 cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus |
8.1 8.2 8.4 8.6 cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus |
8.2 8.4 8.6 cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus |
8.2 8.4 8.6 cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* |
Original advisory text
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weakn...
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00012.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00034.html Mailing List Third Party Advisory
- http://www.securityfocus.com/bid/108042 Broken Link
- https://access.redhat.com/errata/RHSA-2019:1278 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1279 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16877 Issue Tracking Patch Third Party Advisory
- https://github.com/ClusterLabs/pacemaker/pull/1749 Patch Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/01/msg00007.html Mailing List Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/202309-09
- https://usn.ubuntu.com/3952-1/ Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published18 Apr 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-16877 · NVD
Track software like this
Free during beta