The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and     including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to     achieve local privilege escalation. (CVE-2018-16877)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3952-1 advisory.

    Jan Pokorn discovered that Pacemaker incorrectly handled client-server authentication. A local attacker     could possibly use this issue to escalate privileges. (CVE-2018-16877)

    Jan Pokorn discovered that Pacemaker incorrectly handled certain verifications. A local attacker could     possibly use this issue to cause a denial of service. (CVE-2018-16878)

    Jan Pokorn discovered that Pacemaker incorrectly handled certain memory operations. A local attacker     could possibly use this issue to obtain sensitive information in log outputs. This issue only applied to     Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-3885)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for pacemaker fixes the following issues :

Security issues fixed :

  - CVE-2018-16877: Fixed a local privilege escalation     through insufficient IPC client-server authentication.
    (bsc#1131356)

  - CVE-2018-16878: Fixed a denial of service through     insufficient verification inflicted preference of     uncontrolled processes. (bsc#1131353)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

Security fix for CVE-2019-3885, CVE-2018-16877, CVE-2018-16878

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1278 advisory.

    The Pacemaker cluster resource manager is a collection of technologies working together to maintain data     integrity and application availability in the event of failures.

    Security Fix(es):

    * pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)

    * pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

    * pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pacemaker packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way pacemaker's client-server     authentication was implemented in versions up to and     including 2.0.0. A local attacker could use this flaw,     and combine it with other IPC weaknesses, to achieve     local privilege escalation. (CVE-2018-16877)

  - A use-after-free flaw was found in pacemaker up to and     including version 2.0.1 which could result in certain     sensitive information to be leaked via the system logs.
    (CVE-2019-3885)

  - A flaw was found in pacemaker up to and including     version 2.0.1. An insufficient verification inflicted     preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
222268	Linux Distros Unpatched Vulnerability : CVE-2018-16877	Nessus	Misc.	2025/3/4	2025/9/2	high
124274	Ubuntu 16.04 LTS / 18.04 LTS : Pacemaker vulnerabilities (USN-3952-1)	Nessus	Ubuntu Local Security Checks	2019/4/24	2024/8/27	high
124707	openSUSE Security Update : pacemaker (openSUSE-2019-1342)	Nessus	SuSE Local Security Checks	2019/5/9	2024/5/28	high
124604	Fedora 29 : pacemaker (2019-b502250ba4)	Nessus	Fedora Local Security Checks	2019/5/6	2024/5/29	high
124606	Fedora 28 : pacemaker (2019-e71f6f36ac)	Nessus	Fedora Local Security Checks	2019/5/6	2024/5/29	high
125445	RHEL 7 : pacemaker (RHSA-2019:1278)	Nessus	Red Hat Local Security Checks	2019/5/28	2024/11/6	high
131424	NewStart CGSL CORE 5.04 / MAIN 5.04 : pacemaker Multiple Vulnerabilities (NS-SA-2019-0224)	Nessus	NewStart CGSL Local Security Checks	2019/12/2	2022/5/18	high

检测

插件搜索

high

high

high

high

high

high

high