CVE-2018-1086 Information disclosure in pcs
A remote attacker with a valid token can bypass debug parameter removal in the pcsd REST interface to disclose sensitive information and potentially elevate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1086?
CVE-2018-1086 is a medium-severity vulnerability in Debian Debian Linux, published on 12 Apr 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.
Which versions are affected by CVE-2018-1086?
It affects 3 products.
Linux distribution packages (2)
pcs Red Hat:enterprise_linux:6::server | All versions | 0:0.9.155-3.el6 |
pcs-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:0.9.155-3.el6 |
Products include Clusterlabs Pacemaker Command Line Interface, Debian Debian Linux, Redhat Enterprise Linux Server Eus.
How do I fix CVE-2018-1086?
Upgrade to a fixed version.
Is CVE-2018-1086 being exploited?
There is no known exploitation of CVE-2018-1086 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-1086, DSA-4169-1, GHSA-p9pc-vgv7-x9j9, RHSA-2018:1927, UBUNTU-CVE-2018-1086.