-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Low: pcs security, bug fix, and enhancement update
Advisory ID:       RHSA-2021:4142-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:4142
Issue date:        2021-11-09
CVE Names:         CVE-2020-7656 CVE-2020-11023 
====================================================================
1. Summary:

An update for pcs is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux HighAvailability (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux ResilientStorage (v. 8) - ppc64le, s390x, x86_64

3. Description:

The pcs packages provide a command-line configuration system for the
Pacemaker and Corosync utilities.

The following packages have been upgraded to a later upstream version: pcs
(0.10.10). (BZ#1935594)

Security Fix(es):

* jquery: Cross-site scripting (XSS) via

RedHat: RHSA-2021-4142:02 Low: pcs security, bug fix, and enhancement update

An update for pcs is now available for Red Hat Enterprise Linux 8

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.
The following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594)
Security Fix(es):
* jquery: Cross-site scripting (XSS) via


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2020-7656 https://access.redhat.com/security/cve/CVE-2020-11023 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/

Package List

Red Hat Enterprise Linux HighAvailability (v. 8):
Source: pcs-0.10.10-4.el8.src.rpm
aarch64: pcs-0.10.10-4.el8.aarch64.rpm pcs-snmp-0.10.10-4.el8.aarch64.rpm
ppc64le: pcs-0.10.10-4.el8.ppc64le.rpm pcs-snmp-0.10.10-4.el8.ppc64le.rpm
s390x: pcs-0.10.10-4.el8.s390x.rpm pcs-snmp-0.10.10-4.el8.s390x.rpm
x86_64: pcs-0.10.10-4.el8.x86_64.rpm pcs-snmp-0.10.10-4.el8.x86_64.rpm
Red Hat Enterprise Linux ResilientStorage (v. 8):
Source: pcs-0.10.10-4.el8.src.rpm
ppc64le: pcs-0.10.10-4.el8.ppc64le.rpm pcs-snmp-0.10.10-4.el8.ppc64le.rpm
s390x: pcs-0.10.10-4.el8.s390x.rpm pcs-snmp-0.10.10-4.el8.s390x.rpm
x86_64: pcs-0.10.10-4.el8.x86_64.rpm pcs-snmp-0.10.10-4.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2021:4142-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4142
Issued Date: : 2021-11-09
CVE Names: CVE-2020-7656 CVE-2020-11023

Topic

An update for pcs is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Low. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Enterprise Linux HighAvailability (v. 8) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux ResilientStorage (v. 8) - ppc64le, s390x, x86_64


Bugs Fixed

1290830 - [RFE] pcs command is missing a way to retrieve the status of a single resource

1432097 - pcs status nodes shows incomplete information when both standby and maintenance modes are set for a node

1678273 - Moving the last resource from a group may result in an invalid CIB

1690419 - Improve guest node error message when pacemaker_remote is running

1720221 - [RFE] Add support for corosync option totem.block_unlisted_ips

1759995 - [RFE] Need ability to add/remove storage devices with scsi fencing

1841019 - [TechPreview Exit][RFE] Add a 'local' cluster setup command

1850004 - CVE-2020-11023 jquery: Untrusted code execution via

1850119 - CVE-2020-7656 jquery: Cross-site scripting (XSS) via