A pcs security, bug fix, and enhancement update has been released for Red Hat Enterprise Linux 8.
RHSA-2021:4142-02: Low: pcs security, bug fix, and enhancement update
=====================================================================
Red Hat Security Advisory
Synopsis: Low: pcs security, bug fix, and enhancement update
Advisory ID: RHSA-2021:4142-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4142
Issue date: 2021-11-09
CVE Names: CVE-2020-7656 CVE-2020-11023
=====================================================================
1. Summary:
An update for pcs is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux HighAvailability (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux ResilientStorage (v. 8) - ppc64le, s390x, x86_64
3. Description:
The pcs packages provide a command-line configuration system for the
Pacemaker and Corosync utilities.
The following packages have been upgraded to a later upstream version: pcs
(0.10.10). (BZ#1935594)
Security Fix(es):
* jquery: Cross-site scripting (XSS) via HTML tags containing
whitespaces (CVE-2020-7656)
* jquery: Untrusted code execution via tag in HTML passed to DOM
manipulation methods (CVE-2020-11023)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed ( https://bugzilla.redhat.com/):
1290830 - [RFE] pcs command is missing a way to retrieve the status of a single resource
1432097 - pcs status nodes shows incomplete information when both standby and maintenance modes are set for a node
1678273 - Moving the last resource from a group may result in an invalid CIB
1690419 - Improve guest node error message when pacemaker_remote is running
1720221 - [RFE] Add support for corosync option totem.block_unlisted_ips
1759995 - [RFE] Need ability to add/remove storage devices with scsi fencing
1841019 - [TechPreview Exit][RFE] Add a 'local' cluster setup command
1850004 - CVE-2020-11023 jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods
1850119 - CVE-2020-7656 jquery: Cross-site scripting (XSS) via HTML tags containing whitespaces
1854238 - Labeling and Confirmation Dialog for UI Elements start(on)/stop(off)/restart(reboot)
1872378 - [RFE] Provide a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources
1885293 - Support new role terminology in pacemaker 2.1
1885302 - reflect changes in crm_mon --as-xml
1896458 - Default rules with node attributes expressions can be created but are not in effect
1909901 - [RFE] Add --quiet flag to pcs resource disable --safe to only show error messages instead of full output
1922996 - New web UI - add more functionalities to the cluster management
1927384 - New web UI - clone and group settings are not in effect when creating new resource
1927394 - New web UI - cleanup of resource and fence device doesn't work
1930886 - Update help/man pcs to include clone id as an option in 'pcs resource unclone' parameters
1935594 - pcs rebase bz for 8.5
1984901 - sbd can't be enabled via pcs with stopped cluster
1991654 - update-scsi-devices command unfence a node without quorum
1992668 - [RFE] Provide add/remove syntax for command `pcs stonith update-scsi-devices`
1998454 - nginx resource can't be created
6. Package List:
Red Hat Enterprise Linux HighAvailability (v. 8):
Source:
pcs-0.10.10-4.el8.src.rpm
aarch64:
pcs-0.10.10-4.el8.aarch64.rpm
pcs-snmp-0.10.10-4.el8.aarch64.rpm
ppc64le:
pcs-0.10.10-4.el8.ppc64le.rpm
pcs-snmp-0.10.10-4.el8.ppc64le.rpm
s390x:
pcs-0.10.10-4.el8.s390x.rpm
pcs-snmp-0.10.10-4.el8.s390x.rpm
x86_64:
pcs-0.10.10-4.el8.x86_64.rpm
pcs-snmp-0.10.10-4.el8.x86_64.rpm
Red Hat Enterprise Linux ResilientStorage (v. 8):
Source:
pcs-0.10.10-4.el8.src.rpm
ppc64le:
pcs-0.10.10-4.el8.ppc64le.rpm
pcs-snmp-0.10.10-4.el8.ppc64le.rpm
s390x:
pcs-0.10.10-4.el8.s390x.rpm
pcs-snmp-0.10.10-4.el8.s390x.rpm
x86_64:
pcs-0.10.10-4.el8.x86_64.rpm
pcs-snmp-0.10.10-4.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-7656
https://access.redhat.com/security/cve/CVE-2020-11023
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
