The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1279 advisory.

  - pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)

  - pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

  - pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-3885, CVE-2018-16877, CVE-2018-16878

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and     including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to     achieve local privilege escalation. (CVE-2018-16877)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for pacemaker fixes the following issues :

Security issues fixed :

  - CVE-2019-3885: Fixed an information disclosure in log     output. (bsc#1131357)

  - CVE-2018-16877: Fixed a local privilege escalation     through insufficient IPC client-server authentication.
    (bsc#1131356)

  - CVE-2018-16878: Fixed a denial of service through     insufficient verification inflicted preference of     uncontrolled processes. (bsc#1131353)

Non-security issue fixed :

  - crmd: delete resource from lrmd when appropriate to     avoid timeouts with crmsh (bsc#1117381).

This update was imported from the SUSE:SLE-15:Update update project.

Security Fix(es) :

  - pacemaker: Insufficient local IPC client-server     authentication on the client's side can lead to local     privesc (CVE-2018-16877)

  - pacemaker: Insufficient verification inflicted     preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

  - pacemaker: Information disclosure through use-after-free     (CVE-2019-3885)

This update for pacemaker fixes the following issues :

Security issues fixed :

  - CVE-2018-16877: Fixed a local privilege escalation     through insufficient IPC client-server authentication.
    (bsc#1131356)

  - CVE-2018-16878: Fixed a denial of service through     insufficient verification inflicted preference of     uncontrolled processes. (bsc#1131353)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3952-1 advisory.

    Jan Pokorn discovered that Pacemaker incorrectly handled client-server authentication. A local attacker     could possibly use this issue to escalate privileges. (CVE-2018-16877)

    Jan Pokorn discovered that Pacemaker incorrectly handled certain verifications. A local attacker could     possibly use this issue to cause a denial of service. (CVE-2018-16878)

    Jan Pokorn discovered that Pacemaker incorrectly handled certain memory operations. A local attacker     could possibly use this issue to obtain sensitive information in log outputs. This issue only applied to     Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-3885)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
145674	CentOS 8 : pacemaker (CESA-2019:1279)	Nessus	CentOS Local Security Checks	2021/1/29	2022/5/11	high
124549	Fedora 30 : pacemaker (2019-e4c8de3fb7)	Nessus	Fedora Local Security Checks	2019/5/2	2024/5/29	high
222268	Linux Distros Unpatched Vulnerability : CVE-2018-16877	Nessus	Misc.	2025/3/4	2025/9/2	high
125213	openSUSE Security Update : pacemaker (openSUSE-2019-1400)	Nessus	SuSE Local Security Checks	2019/5/16	2024/5/22	high
125531	Scientific Linux Security Update : pacemaker on SL7.x x86_64 (20190528)	Nessus	Scientific Linux Local Security Checks	2019/5/29	2024/5/20	high
124707	openSUSE Security Update : pacemaker (openSUSE-2019-1342)	Nessus	SuSE Local Security Checks	2019/5/9	2024/5/28	high
124274	Ubuntu 16.04 LTS / 18.04 LTS : Pacemaker vulnerabilities (USN-3952-1)	Nessus	Ubuntu Local Security Checks	2019/4/24	2024/8/27	high

检测

插件搜索

high

high

high

high

high

high

high