RHSA-2021:4142 - Security Advisory

Topic

An update for pcs is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

The following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594)

Security Fix(es):

• jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656)
• jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux High Availability for x86_64 8 x86_64
• Red Hat Enterprise Linux High Availability for ARM 64 8 aarch64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 8 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux Resilient Storage for IBM z Systems 8 s390x
• Red Hat Enterprise Linux High Availability for IBM z Systems 8 s390x
• Red Hat Enterprise Linux Resilient Storage for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux Resilient Storage for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux Resilient Storage for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux High Availability for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux High Availability for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux High Availability for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux High Availability for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux High Availability for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux High Availability (for IBM z Systems) - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux High Availability (for IBM z Systems) - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux High Availability (for ARM 64) - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux High Availability (for ARM 64) - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux Resilient Storage for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux Resilient Storage for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux High Availability for x86_64 - Telecommunications Update Service 8.8 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Telecommunications Update Service 8.6 x86_64

Fixes

• BZ - 1290830 - [RFE] pcs command is missing a way to retrieve the status of a single resource
• BZ - 1432097 - pcs status nodes shows incomplete information when both standby and maintenance modes are set for a node
• BZ - 1678273 - Moving the last resource from a group may result in an invalid CIB
• BZ - 1690419 - Improve guest node error message when pacemaker_remote is running
• BZ - 1720221 - [RFE] Add support for corosync option totem.block_unlisted_ips
• BZ - 1759995 - [RFE] Need ability to add/remove storage devices with scsi fencing
• BZ - 1841019 - [TechPreview Exit][RFE] Add a 'local' cluster setup command
• BZ - 1850004 - CVE-2020-11023 jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
• BZ - 1850119 - CVE-2020-7656 jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces
• BZ - 1854238 - Labeling and Confirmation Dialog for UI Elements start(on)/stop(off)/restart(reboot)
• BZ - 1872378 - [RFE] Provide a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources
• BZ - 1885293 - Support new role terminology in pacemaker 2.1
• BZ - 1885302 - reflect changes in crm_mon --as-xml
• BZ - 1896458 - Default rules with node attributes expressions can be created but are not in effect
• BZ - 1909901 - [RFE] Add --quiet flag to pcs resource disable --safe to only show error messages instead of full output
• BZ - 1922996 - New web UI - add more functionalities to the cluster management
• BZ - 1927384 - New web UI - clone and group settings are not in effect when creating new resource
• BZ - 1927394 - New web UI - cleanup of resource and fence device doesn't work
• BZ - 1930886 - Update help/man pcs to include clone id as an option in 'pcs resource unclone' parameters
• BZ - 1935594 - pcs rebase bz for 8.5
• BZ - 1984901 - sbd can't be enabled via pcs with stopped cluster
• BZ - 1991654 - update-scsi-devices command unfence a node without quorum
• BZ - 1992668 - [RFE] Provide add/remove syntax for command `pcs stonith update-scsi-devices`
• BZ - 1998454 - nginx resource can't be created

CVEs

• CVE-2019-11358
• CVE-2020-7656
• CVE-2020-11023

References

• https://access.redhat.com/security/updates/classification/#low
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/