rhsa-2015_2290
Vulnerability from csaf_redhat
Published
2015-11-19 04:43
Modified
2024-11-22 09:14
Summary
Red Hat Security Advisory: pcs security, bug fix, and enhancement update

Notes

Topic
An updated pcs package that fixes one security issue, several bugs, and add various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
The pcs package provides a configuration tool for Corosync and Pacemaker. It permits users to easily view, modify and create Pacemaker based clusters. The pcs package includes Rack, which provides a minimal interface between webservers that support Ruby and Ruby frameworks. A flaw was found in a way Rack processed parameters of incoming requests. An attacker could use this flaw to send a crafted request that would cause an application using Rack to crash. (CVE-2015-3225) Red Hat would like to thank Ruby upstream developers for reporting this. Upstream acknowledges Tomek Rabczak from the NCC Group as the original reporter. The pcs package has been upgraded to upstream version 0.9.143, which provides a number of bug fixes and enhancements over the previous version. (BZ#1198265) The following enhancements are described in more detail in the Red Hat Enterprise Linux 7.2 Release Notes, linked to from the References section: * The pcs resource move and pcs resource ban commands now display a warning message to clarify the commands' behavior (BZ#1201452) * New command to move a Pacemaker resource to its preferred node (BZ#1122818) This update also fixes the following bugs: * Before this update, a bug caused location, ordering, and colocation constraints related to a resource group to be removed when removing any resource from that group. This bug has been fixed, and the constraints are now preserved until the group has no resources left, and is removed. (BZ#1158537) * Previously, when a user disabled a resource clone or multi-state resource, and then later enabled a primitive resource within it, the clone or multi-state resource remained disabled. With this update, enabling a resource within a disabled clone or multi-state resource enables it. (BZ#1218979) * When the web UI displayed a list of resource attributes, a bug caused the list to be truncated at the first "=" character. This update fixes the bug and now the web UI displays lists of resource attributes correctly. (BZ#1243579) * The documentation for the "pcs stonith confirm" command was not clear. This could lead to incorrect usage of the command, which could in turn cause data corruption. With this update, the documentation has been improved and the "pcs stonith confirm" command is now more clearly explained. (BZ#1245264) * Previously, if there were any unauthenticated nodes, creating a new cluster, adding a node to an existing cluster, or adding a cluster to the web UI failed with the message "Node is not authenticated". With this update, when the web UI detects a problem with authentication, the web UI displays a dialog to authenticate nodes as necessary. (BZ#1158569) * Previously, the web UI displayed only primitive resources. Thus there was no way to set attributes, constraints and other properties separately for a parent resource and a child resource. This has now been fixed, and resources are displayed in a tree structure, meaning all resource elements can be viewed and edited independently. (BZ#1189857) In addition, this update adds the following enhancements: * A dashboard has been added which shows the status of clusters in the web UI. Previously, it was not possible to view all important information about clusters in one place. Now, a dashboard showing the status of clusters has been added to the main page of the web UI. (BZ#1158566) * With this update, the pcsd daemon automatically synchronizes pcsd configuration across a cluster. This enables the web UI to be run from any node, allowing management even if any particular node is down. (BZ#1158577) * The web UI can now be used to set permissions for users and groups on a cluster. This allows users and groups to have their access restricted to certain operations on certain clusters. (BZ#1158571) All pcs users are advised to upgrade to this updated package, which corrects these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated pcs package that fixes one security issue, several bugs, and\nadd various enhancements is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The pcs package provides a configuration tool for Corosync and Pacemaker.\nIt permits users to easily view, modify and create Pacemaker based\nclusters. The pcs package includes Rack, which provides a minimal interface\nbetween webservers that support Ruby and Ruby frameworks.\n\nA flaw was found in a way Rack processed parameters of incoming requests.\nAn attacker could use this flaw to send a crafted request that would cause\nan application using Rack to crash. (CVE-2015-3225)\n\nRed Hat would like to thank Ruby upstream developers for reporting this.\nUpstream acknowledges Tomek Rabczak from the NCC Group as the original\nreporter.\n\nThe pcs package has been upgraded to upstream version 0.9.143, which\nprovides a number of bug fixes and enhancements over the previous version.\n(BZ#1198265)\n\nThe following enhancements are described in more detail in the Red Hat\nEnterprise Linux 7.2 Release Notes, linked to from the References section:\n\n* The pcs resource move and pcs resource ban commands now display a warning\nmessage to clarify the commands\u0027 behavior (BZ#1201452)\n\n* New command to move a Pacemaker resource to its preferred node\n(BZ#1122818)\n\nThis update also fixes the following bugs:\n\n* Before this update, a bug caused location, ordering, and colocation\nconstraints related to a resource group to be removed when removing any\nresource from that group. This bug has been fixed, and the constraints are\nnow preserved until the group has no resources left, and is removed.\n(BZ#1158537)\n\n* Previously, when a user disabled a resource clone or multi-state\nresource, and then later enabled a primitive resource within it, the clone\nor multi-state resource remained disabled. With this update, enabling a\nresource within a disabled clone or multi-state resource enables it.\n(BZ#1218979)\n\n* When the web UI displayed a list of resource attributes, a bug caused\nthe list to be truncated at the first \"=\" character. This update fixes the\nbug and now the web UI displays lists of resource attributes correctly.\n(BZ#1243579)\n\n* The documentation for the \"pcs stonith confirm\" command was not clear.\nThis could lead to incorrect usage of the command, which could in turn\ncause data corruption. With this update, the documentation has been\nimproved and the \"pcs stonith confirm\" command is now more clearly\nexplained. (BZ#1245264)\n\n* Previously, if there were any unauthenticated nodes, creating a new\ncluster, adding a node to an existing cluster, or adding a cluster to the\nweb UI failed with the message \"Node is not authenticated\". With this\nupdate, when the web UI detects a problem with authentication, the web UI\ndisplays a dialog to authenticate nodes as necessary. (BZ#1158569)\n\n* Previously, the web UI displayed only primitive resources. Thus there was\nno way to set attributes, constraints and other properties separately for a\nparent resource and a child resource. This has now been fixed, and\nresources are displayed in a tree structure, meaning all resource elements\ncan be viewed and edited independently. (BZ#1189857)\n\nIn addition, this update adds the following enhancements:\n\n* A dashboard has been added which shows the status of clusters in the web\nUI. Previously, it was not possible to view all important information about\nclusters in one place. Now, a dashboard showing the status of clusters has\nbeen added to the main page of the web UI. (BZ#1158566)\n\n* With this update, the pcsd daemon automatically synchronizes pcsd\nconfiguration across a cluster. This enables the web UI to be run from any\nnode, allowing management even if any particular node is down. (BZ#1158577)\n\n* The web UI can now be used to set permissions for users and groups on a\ncluster. This allows users and groups to have their access restricted to\ncertain operations on certain clusters. (BZ#1158571)\n\nAll pcs users are advised to upgrade to this updated package, which\ncorrects these issues and add these enhancements.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2290",
        "url": "https://access.redhat.com/errata/RHSA-2015:2290"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/High_Availability_Add-On_Reference/",
        "url": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/High_Availability_Add-On_Reference/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.2_Release_Notes/index.html",
        "url": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.2_Release_Notes/index.html"
      },
      {
        "category": "external",
        "summary": "1121791",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121791"
      },
      {
        "category": "external",
        "summary": "1134426",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1134426"
      },
      {
        "category": "external",
        "summary": "1148863",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148863"
      },
      {
        "category": "external",
        "summary": "1158491",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1158491"
      },
      {
        "category": "external",
        "summary": "1158537",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1158537"
      },
      {
        "category": "external",
        "summary": "1158571",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1158571"
      },
      {
        "category": "external",
        "summary": "1163671",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163671"
      },
      {
        "category": "external",
        "summary": "1163682",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163682"
      },
      {
        "category": "external",
        "summary": "1165803",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165803"
      },
      {
        "category": "external",
        "summary": "1166160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1166160"
      },
      {
        "category": "external",
        "summary": "1170205",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1170205"
      },
      {
        "category": "external",
        "summary": "1175400",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175400"
      },
      {
        "category": "external",
        "summary": "1176687",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1176687"
      },
      {
        "category": "external",
        "summary": "1182119",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1182119"
      },
      {
        "category": "external",
        "summary": "1182793",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1182793"
      },
      {
        "category": "external",
        "summary": "1182986",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1182986"
      },
      {
        "category": "external",
        "summary": "1183752",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1183752"
      },
      {
        "category": "external",
        "summary": "1185096",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1185096"
      },
      {
        "category": "external",
        "summary": "1186692",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1186692"
      },
      {
        "category": "external",
        "summary": "1187320",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1187320"
      },
      {
        "category": "external",
        "summary": "1187571",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1187571"
      },
      {
        "category": "external",
        "summary": "1188571",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1188571"
      },
      {
        "category": "external",
        "summary": "1189857",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1189857"
      },
      {
        "category": "external",
        "summary": "1196412",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1196412"
      },
      {
        "category": "external",
        "summary": "1197758",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1197758"
      },
      {
        "category": "external",
        "summary": "1198222",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1198222"
      },
      {
        "category": "external",
        "summary": "1198265",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1198265"
      },
      {
        "category": "external",
        "summary": "1198274",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1198274"
      },
      {
        "category": "external",
        "summary": "1198640",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1198640"
      },
      {
        "category": "external",
        "summary": "1199073",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1199073"
      },
      {
        "category": "external",
        "summary": "1202457",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1202457"
      },
      {
        "category": "external",
        "summary": "1204880",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1204880"
      },
      {
        "category": "external",
        "summary": "1205653",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205653"
      },
      {
        "category": "external",
        "summary": "1206214",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1206214"
      },
      {
        "category": "external",
        "summary": "1206219",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1206219"
      },
      {
        "category": "external",
        "summary": "1207805",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1207805"
      },
      {
        "category": "external",
        "summary": "1212904",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1212904"
      },
      {
        "category": "external",
        "summary": "1213429",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1213429"
      },
      {
        "category": "external",
        "summary": "1215198",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1215198"
      },
      {
        "category": "external",
        "summary": "1219574",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1219574"
      },
      {
        "category": "external",
        "summary": "1231987",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1231987"
      },
      {
        "category": "external",
        "summary": "1232292",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1232292"
      },
      {
        "category": "external",
        "summary": "1235022",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1235022"
      },
      {
        "category": "external",
        "summary": "1247818",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1247818"
      },
      {
        "category": "external",
        "summary": "1250720",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1250720"
      },
      {
        "category": "external",
        "summary": "1253491",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1253491"
      },
      {
        "category": "external",
        "summary": "1257369",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1257369"
      },
      {
        "category": "external",
        "summary": "1258619",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258619"
      },
      {
        "category": "external",
        "summary": "1265425",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265425"
      },
      {
        "category": "external",
        "summary": "1268801",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1268801"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2290.json"
      }
    ],
    "title": "Red Hat Security Advisory: pcs security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-22T09:14:12+00:00",
      "generator": {
        "date": "2024-11-22T09:14:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2015:2290",
      "initial_release_date": "2015-11-19T04:43:53+00:00",
      "revision_history": [
        {
          "date": "2015-11-19T04:43:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2015-11-19T04:43:53+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T09:14:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server High Availability (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server High Availability (v. 7)",
                  "product_id": "7Server-HighAvailability",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Resilient Storage (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Resilient Storage (v. 7)",
                  "product_id": "7Server-ResilientStorage",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pcs-0:0.9.143-15.el7.src",
                "product": {
                  "name": "pcs-0:0.9.143-15.el7.src",
                  "product_id": "pcs-0:0.9.143-15.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs@0.9.143-15.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pcs-debuginfo-0:0.9.143-15.el7.s390x",
                "product": {
                  "name": "pcs-debuginfo-0:0.9.143-15.el7.s390x",
                  "product_id": "pcs-debuginfo-0:0.9.143-15.el7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs-debuginfo@0.9.143-15.el7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pcs-0:0.9.143-15.el7.s390x",
                "product": {
                  "name": "pcs-0:0.9.143-15.el7.s390x",
                  "product_id": "pcs-0:0.9.143-15.el7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs@0.9.143-15.el7?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pcs-0:0.9.143-15.el7.x86_64",
                "product": {
                  "name": "pcs-0:0.9.143-15.el7.x86_64",
                  "product_id": "pcs-0:0.9.143-15.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs@0.9.143-15.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pcs-debuginfo-0:0.9.143-15.el7.x86_64",
                "product": {
                  "name": "pcs-debuginfo-0:0.9.143-15.el7.x86_64",
                  "product_id": "pcs-debuginfo-0:0.9.143-15.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs-debuginfo@0.9.143-15.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server High Availability (v. 7)",
          "product_id": "7Server-HighAvailability:pcs-0:0.9.143-15.el7.s390x"
        },
        "product_reference": "pcs-0:0.9.143-15.el7.s390x",
        "relates_to_product_reference": "7Server-HighAvailability"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.9.143-15.el7.src as a component of Red Hat Enterprise Linux Server High Availability (v. 7)",
          "product_id": "7Server-HighAvailability:pcs-0:0.9.143-15.el7.src"
        },
        "product_reference": "pcs-0:0.9.143-15.el7.src",
        "relates_to_product_reference": "7Server-HighAvailability"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server High Availability (v. 7)",
          "product_id": "7Server-HighAvailability:pcs-0:0.9.143-15.el7.x86_64"
        },
        "product_reference": "pcs-0:0.9.143-15.el7.x86_64",
        "relates_to_product_reference": "7Server-HighAvailability"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-debuginfo-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server High Availability (v. 7)",
          "product_id": "7Server-HighAvailability:pcs-debuginfo-0:0.9.143-15.el7.s390x"
        },
        "product_reference": "pcs-debuginfo-0:0.9.143-15.el7.s390x",
        "relates_to_product_reference": "7Server-HighAvailability"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-debuginfo-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server High Availability (v. 7)",
          "product_id": "7Server-HighAvailability:pcs-debuginfo-0:0.9.143-15.el7.x86_64"
        },
        "product_reference": "pcs-debuginfo-0:0.9.143-15.el7.x86_64",
        "relates_to_product_reference": "7Server-HighAvailability"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)",
          "product_id": "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.s390x"
        },
        "product_reference": "pcs-0:0.9.143-15.el7.s390x",
        "relates_to_product_reference": "7Server-ResilientStorage"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.9.143-15.el7.src as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)",
          "product_id": "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.src"
        },
        "product_reference": "pcs-0:0.9.143-15.el7.src",
        "relates_to_product_reference": "7Server-ResilientStorage"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)",
          "product_id": "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.x86_64"
        },
        "product_reference": "pcs-0:0.9.143-15.el7.x86_64",
        "relates_to_product_reference": "7Server-ResilientStorage"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-debuginfo-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)",
          "product_id": "7Server-ResilientStorage:pcs-debuginfo-0:0.9.143-15.el7.s390x"
        },
        "product_reference": "pcs-debuginfo-0:0.9.143-15.el7.s390x",
        "relates_to_product_reference": "7Server-ResilientStorage"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-debuginfo-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)",
          "product_id": "7Server-ResilientStorage:pcs-debuginfo-0:0.9.143-15.el7.x86_64"
        },
        "product_reference": "pcs-debuginfo-0:0.9.143-15.el7.x86_64",
        "relates_to_product_reference": "7Server-ResilientStorage"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Tomek Rabczak"
          ],
          "organization": "NCC Group",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2015-3225",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2015-06-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1232292"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in a way Rack processed parameters of incoming requests. An attacker could use this flaw to send a crafted request that would cause an application using Rack to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-rack: Potential Denial of Service Vulnerability in Rack normalize_params()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-HighAvailability:pcs-0:0.9.143-15.el7.s390x",
          "7Server-HighAvailability:pcs-0:0.9.143-15.el7.src",
          "7Server-HighAvailability:pcs-0:0.9.143-15.el7.x86_64",
          "7Server-HighAvailability:pcs-debuginfo-0:0.9.143-15.el7.s390x",
          "7Server-HighAvailability:pcs-debuginfo-0:0.9.143-15.el7.x86_64",
          "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.s390x",
          "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.src",
          "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.x86_64",
          "7Server-ResilientStorage:pcs-debuginfo-0:0.9.143-15.el7.s390x",
          "7Server-ResilientStorage:pcs-debuginfo-0:0.9.143-15.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3225"
        },
        {
          "category": "external",
          "summary": "RHBZ#1232292",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1232292"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3225",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3225"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3225",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3225"
        }
      ],
      "release_date": "2015-06-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-11-19T04:43:53+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-HighAvailability:pcs-0:0.9.143-15.el7.s390x",
            "7Server-HighAvailability:pcs-0:0.9.143-15.el7.src",
            "7Server-HighAvailability:pcs-0:0.9.143-15.el7.x86_64",
            "7Server-HighAvailability:pcs-debuginfo-0:0.9.143-15.el7.s390x",
            "7Server-HighAvailability:pcs-debuginfo-0:0.9.143-15.el7.x86_64",
            "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.s390x",
            "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.src",
            "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.x86_64",
            "7Server-ResilientStorage:pcs-debuginfo-0:0.9.143-15.el7.s390x",
            "7Server-ResilientStorage:pcs-debuginfo-0:0.9.143-15.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2290"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "7Server-HighAvailability:pcs-0:0.9.143-15.el7.s390x",
            "7Server-HighAvailability:pcs-0:0.9.143-15.el7.src",
            "7Server-HighAvailability:pcs-0:0.9.143-15.el7.x86_64",
            "7Server-HighAvailability:pcs-debuginfo-0:0.9.143-15.el7.s390x",
            "7Server-HighAvailability:pcs-debuginfo-0:0.9.143-15.el7.x86_64",
            "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.s390x",
            "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.src",
            "7Server-ResilientStorage:pcs-0:0.9.143-15.el7.x86_64",
            "7Server-ResilientStorage:pcs-debuginfo-0:0.9.143-15.el7.s390x",
            "7Server-ResilientStorage:pcs-debuginfo-0:0.9.143-15.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-rack: Potential Denial of Service Vulnerability in Rack normalize_params()"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.