RHSA-2015:2290 - Security Advisory

Topic

An updated pcs package that fixes one security issue, several bugs, and
add various enhancements is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

The pcs package provides a configuration tool for Corosync and Pacemaker.
It permits users to easily view, modify and create Pacemaker based
clusters. The pcs package includes Rack, which provides a minimal interface
between webservers that support Ruby and Ruby frameworks.

A flaw was found in a way Rack processed parameters of incoming requests.
An attacker could use this flaw to send a crafted request that would cause
an application using Rack to crash. (CVE-2015-3225)

Red Hat would like to thank Ruby upstream developers for reporting this.
Upstream acknowledges Tomek Rabczak from the NCC Group as the original
reporter.

The pcs package has been upgraded to upstream version 0.9.143, which
provides a number of bug fixes and enhancements over the previous version.
(BZ#1198265)

The following enhancements are described in more detail in the Red Hat
Enterprise Linux 7.2 Release Notes, linked to from the References section:

• The pcs resource move and pcs resource ban commands now display a warning

message to clarify the commands' behavior (BZ#1201452)

• New command to move a Pacemaker resource to its preferred node

(BZ#1122818)

This update also fixes the following bugs:

• Before this update, a bug caused location, ordering, and colocation

constraints related to a resource group to be removed when removing any
resource from that group. This bug has been fixed, and the constraints are
now preserved until the group has no resources left, and is removed.
(BZ#1158537)

• Previously, when a user disabled a resource clone or multi-state

resource, and then later enabled a primitive resource within it, the clone
or multi-state resource remained disabled. With this update, enabling a
resource within a disabled clone or multi-state resource enables it.
(BZ#1218979)

• When the web UI displayed a list of resource attributes, a bug caused

the list to be truncated at the first "=" character. This update fixes the
bug and now the web UI displays lists of resource attributes correctly.
(BZ#1243579)

• The documentation for the "pcs stonith confirm" command was not clear.

This could lead to incorrect usage of the command, which could in turn
cause data corruption. With this update, the documentation has been
improved and the "pcs stonith confirm" command is now more clearly
explained. (BZ#1245264)

• Previously, if there were any unauthenticated nodes, creating a new

cluster, adding a node to an existing cluster, or adding a cluster to the
web UI failed with the message "Node is not authenticated". With this
update, when the web UI detects a problem with authentication, the web UI
displays a dialog to authenticate nodes as necessary. (BZ#1158569)

• Previously, the web UI displayed only primitive resources. Thus there was

no way to set attributes, constraints and other properties separately for a
parent resource and a child resource. This has now been fixed, and
resources are displayed in a tree structure, meaning all resource elements
can be viewed and edited independently. (BZ#1189857)

In addition, this update adds the following enhancements:

• A dashboard has been added which shows the status of clusters in the web

UI. Previously, it was not possible to view all important information about
clusters in one place. Now, a dashboard showing the status of clusters has
been added to the main page of the web UI. (BZ#1158566)

• With this update, the pcsd daemon automatically synchronizes pcsd

configuration across a cluster. This enables the web UI to be run from any
node, allowing management even if any particular node is down. (BZ#1158577)

• The web UI can now be used to set permissions for users and groups on a

cluster. This allows users and groups to have their access restricted to
certain operations on certain clusters. (BZ#1158571)

All pcs users are advised to upgrade to this updated package, which
corrects these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux High Availability for x86_64 7 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 7 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux High Availability (for RHEL Server) from RHUI 7 x86_64
• Red Hat Enterprise Linux Resilient Storage (for RHEL Server) from RHUI 7 x86_64
• Red Hat Enterprise Linux Resilient Storage for IBM z Systems 7 s390x
• Red Hat Enterprise Linux High Availability for IBM z Systems 7 s390x
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 1121791 - Provide documentation of batch-limit and other pacemaker properties in man page or pcs help
• BZ - 1134426 - pcs needs a better parser for corosync.conf
• BZ - 1148863 - Pcsd backward/forward compatibility issues
• BZ - 1158491 - 'pcs cluster status' is documented to be an alias to 'pcs status cluster' but has different output
• BZ - 1158537 - Removing a resource from a group also removes constraints mentioning that group
• BZ - 1158571 - user and group support in gui - permissions to clusters managed by pcsd
• BZ - 1163671 - [RFE] Default corosync configuration should log to file
• BZ - 1163682 - nodes authentication stops if failed on one node
• BZ - 1165803 - pcs CLI should recognize and act upon "fail due to lack of authentication" state if/as suitable (e.g. for "pcs config restore")
• BZ - 1166160 - 'pcs acl role create' does not check syntax properly
• BZ - 1170205 - pcs cluster auth --force doesn't overwrite /var/lib/pcsd/tokens if its content is corrupt
• BZ - 1175400 - pcs resource op add creates duplicate op entires
• BZ - 1176687 - Pacemaker resource defaults should show up in 'pcs config' output
• BZ - 1182119 - A cloned resource banned on one of the nodes is shown as Inactive in GUI
• BZ - 1182793 - When attempting to add a duplicate fence level we get a non-useful error message
• BZ - 1182986 - Unable to find out value for require-all parameter for ordering constraint with clones
• BZ - 1183752 - Unable to delete VirtualDomain resource remote-node when it has configured some constraints
• BZ - 1185096 - debug-promote implementation
• BZ - 1186692 - cluster node removal should verify possible loss of quorum
• BZ - 1187320 - Uncloning a non-cloned resource produces invalid CIB
• BZ - 1187571 - ungrouping a resource from a cloned group produces invalid CIB when other resources exist in that group
• BZ - 1188571 - The --wait functionality implementation needs an overhaul
• BZ - 1189857 - need a tree view for clones/MS/groups in the resource panel [GUI]
• BZ - 1196412 - pcs cluster start should go to pcsd if user is not root
• BZ - 1197758 - pcs does not inform about incorrect command usage (pcs constraint order set)
• BZ - 1198222 - pcsd: GUI fails if orphaned resource is present in a cluster
• BZ - 1198265 - PCS Rebase bug for 7.2
• BZ - 1198274 - pcsd: don't automatically use --force everytime a resource is being removed
• BZ - 1198640 - [WebUI] spaces not allowed in resource agent options fields
• BZ - 1199073 - creating a resource name colliding with an existing group/clone/master ID needs better error message
• BZ - 1202457 - Referencing a non-existent ACL role should error out more gracefully
• BZ - 1204880 - pcs: stonith level value checking
• BZ - 1205653 - pcsd gui is not able to remove constraints and standby/unstandby nodes of remote cluster
• BZ - 1206214 - Formatting of longdesc metadata of resource agent is destroyed when using "pcs resource describe"
• BZ - 1206219 - pcs stonith describe only lists parameters of fence agent, but not description
• BZ - 1207805 - Need a way for pcs to clear out auth tokens
• BZ - 1212904 - better integration with standalone (unbundled) clufter package for cluster configuration conversion
• BZ - 1213429 - Cluster request fails on first node if this is not authorized
• BZ - 1215198 - pcsd: GUI ignores timeout value in fence_xvm agent form
• BZ - 1219574 - [gui] resource optional arguments: quoted strings missing
• BZ - 1231987 - pcs ought to require psmisc package (hidden dependency for killall execution)
• BZ - 1232292 - CVE-2015-3225 rubygem-rack: Potential Denial of Service Vulnerability in Rack normalize_params()
• BZ - 1235022 - Nagios metadata is missing
• BZ - 1247818 - pcs depends on initscripts
• BZ - 1250720 - traceback when running 'pcs resource enable clvmd --wait'
• BZ - 1253491 - pcs status pcsd shows "Unable to authenticate" on serial console
• BZ - 1257369 - pcs should print the output of crm_resource from pcs resource cleanup commands
• BZ - 1258619 - Ruby traceback on pcsd startup - /webrick.rb:48:in `shutdown': undefined method `shutdown'
• BZ - 1265425 - pcs is not parsing the output of crm_node properly
• BZ - 1268801 - A change in "crm_resource --set-parameter is-managed" introduces regression for Clone and M/S resources

CVEs

• CVE-2015-3225

References

• http://www.redhat.com/security/updates/classification/#normal