MGASA-2021-0049 - Updated crmsh packages fix security vulnerability Publication date: 22 Jan 2021 URL: https://advisories.mageia.org/MGASA-2021-0049.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-25459 The crm configure and hb_report commands failed to sanitize sensitive information by default (bsc#1163581). An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges (CVE-2020-25459). The crmsh package has been updated to the latest git snapshot and patched for CVE-2020-25459, fixing these issues and several others. References: - https://bugs.mageia.org/show_bug.cgi?id=27444 - https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00032.html - https://lists.opensuse.org/archives/list/[email protected]/thread/RKSUG2OZN3Y2FQVQ55HP5MZIQZXZ5OD6/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25459 SRPMS: - 7/core/crmsh-4.2.0-0.39d42c2.1.1.mga7
Mageia 2021-0049: crmsh security update
The crm configure and hb_report commands failed to sanitize sensitive information by default (bsc#1163581)
Summary
CVE: CVE-2020-25459
The crm configure and hb_report commands failed to sanitize sensitive
information by default (bsc#1163581).
An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers
able to call "crm history" (when "crm" is run) were able to execute commands
via shell code injection to the crm history commandline, potentially allowing
escalation of privileges (CVE-2020-25459).
The crmsh package has been updated to the latest git snapshot and patched for
CVE-2020-25459, fixing these issues and several others.
Resolution
MGASA-2021-0049 - Updated crmsh packages fix security vulnerability
References
- https://bugs.mageia.org/show_bug.cgi?id=27444
- https://lists.opensuse.org/opensuse-security-announce/2020-10/msg00032.html
- https://lists.opensuse.org/archives/list/[email protected]/thread/RKSUG2OZN3Y2FQVQ55HP5MZIQZXZ5OD6/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25459
Severity
Issued Date: 22 Jan 2021
URL: https://advisories.mageia.org/MGASA-2021-0049.html
Type: security
Affected Mageia releases: 7
News
HOWTOs
Features
Time is running out for CentOS 8
Open-Source Tool of the Month: Uptycs Addresses Modern Cloud-Native & Containerization Security Challenges with its Uptycs Security Analytics Platform
Best File and Disk Encryption Tools For Linux
Best Linux Backup Solutions to Prevent Data Loss in A Ransomware Attack
What You Need to Know About Linux Rootkits
About Us
Powered By
