Synopsis: Low: pacemaker security, bug fix, and enhancement update
Advisory ID: SLSA-2013:1635-2
Issue Date: 2013-11-21
CVE Numbers: CVE-2013-0281
--
A denial of service flaw was found in the way Pacemaker performed
authentication and processing of remote connections in certain
circumstances. When Pacemaker was configured to allow remote Cluster
Information Base (CIB) configuration or resource management, a remote
attacker could use this flaw to cause Pacemaker to block indefinitely
(preventing it from serving other requests). (CVE-2013-0281)
Note: The default Pacemaker configuration in Scientific Linux 6 has the
remote CIB management functionality disabled.
The pacemaker package has been upgraded to upstream version 1.1.10, which
provides a number of bug fixes and enhancements over the previous version:
* Pacemaker no longer assumes unknown cman nodes are safely stopped.
* The core dump file now converts all exit codes into positive 'errno'
values.
* Pacemaker ensures a return to a stable state after too many fencing
failures, and initiates a shutdown if a node claimed to be fenced is still
active.
* The crm_error tool adds the ability to list and print error symbols.
* The crm_resource command allows individual resources to be reprobed, and
implements the "--ban" option for moving resources away from nodes. The "
--clear" option has replaced the "--unmove" option. Also, crm_resource now
supports OCF tracing when using the "--force" option.
* The IPC mechanism restores the ability for members of the haclient group
to connect to the cluster.
* The Policy Engine daemon allows active nodes in the current membership
to be fenced without quorum.
* Policy Engine now suppresses meaningless IDs when displaying anonymous
clone status, supports maintenance mode for a single node, and correctly
handles the recovered resources before they are operated on.
* XML configuration files are now checked for non-printing characters and
replaced with their octal equivalent when exporting XML text. Also, a more
reliable buffer allocation strategy has been implemented to prevent
lockups.
Additional bug fixes:
* The "crm_resource --move" command was designed for atomic resources and
could not handle resources on clones, masters, or slaves present on
multiple nodes. Consequently, crm_resource could not obtain enough
information to move a resource and did not perform any action. The "--ban"
and "--clear" options have been added to allow the administrator to
instruct the cluster unambiguously. Clone, master, and slave resources can
now be navigated within the cluster as expected.
* The hacluster user account did not have a user identification (UID) or
group identification (GID) number reserved on the system. Thus, UID and
GID values were picked randomly during the installation process. The UID
and GID number 189 was reserved for hacluster and is now used consistently
for all installations.
* Certain clusters used node host names that did not match the output of
the "uname -n" command. Thus, the default node name used by the
crm_standby and crm_failcount commands was incorrect and caused the
cluster to ignore the update by the administrator. The crm_node command is
now used instead of the uname utility in helper scripts. As a result, the
cluster behaves as expected.
* Due to incorrect return code handling, internal recovery logic of the
crm_mon utility was not executed when a configuration updated failed to
apply, leading to an assertion failure. Return codes are now checked
correctly, and the recovery of an expected error state is now handled
transparently.
* cman's automatic unfencing feature failed when combined with Pacemaker.
Support for automated unfencing in Pacemaker has been added, and the
unwanted behavior no longer occurs.
--
SL6
x86_64
pacemaker-1.1.10-14.el6.x86_64.rpm
pacemaker-cli-1.1.10-14.el6.x86_64.rpm
pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm
pacemaker-cluster-libs-1.1.10-14.el6.x86_64.rpm
pacemaker-cts-1.1.10-14.el6.x86_64.rpm
pacemaker-debuginfo-1.1.10-14.el6.i686.rpm
pacemaker-debuginfo-1.1.10-14.el6.x86_64.rpm
pacemaker-doc-1.1.10-14.el6.x86_64.rpm
pacemaker-libs-1.1.10-14.el6.i686.rpm
pacemaker-libs-1.1.10-14.el6.x86_64.rpm
pacemaker-libs-devel-1.1.10-14.el6.i686.rpm
pacemaker-libs-devel-1.1.10-14.el6.x86_64.rpm
pacemaker-remote-1.1.10-14.el6.x86_64.rpm
i386
pacemaker-1.1.10-14.el6.i686.rpm
pacemaker-cli-1.1.10-14.el6.i686.rpm
pacemaker-cluster-libs-1.1.10-14.el6.i686.rpm
pacemaker-cts-1.1.10-14.el6.i686.rpm
pacemaker-debuginfo-1.1.10-14.el6.i686.rpm
pacemaker-doc-1.1.10-14.el6.i686.rpm
pacemaker-libs-1.1.10-14.el6.i686.rpm
pacemaker-libs-devel-1.1.10-14.el6.i686.rpm
pacemaker-remote-1.1.10-14.el6.i686.rpm
The following RPMs were added for dependency resolution:
x86_64
clusterlib-3.0.12.1-59.el6.i686.rpm
clusterlib-3.0.12.1-59.el6.x86_64.rpm
clusterlib-devel-3.0.12.1-59.el6.i686.rpm
clusterlib-devel-3.0.12.1-59.el6.x86_64.rpm
cman-3.0.12.1-59.el6.x86_64.rpm
corosync-1.4.1-17.el6.x86_64.rpm
corosynclib-1.4.1-17.el6.i686.rpm
corosynclib-1.4.1-17.el6.x86_64.rpm
corosynclib-devel-1.4.1-17.el6.i686.rpm
corosynclib-devel-1.4.1-17.el6.x86_64.rpm
fence-agents-3.1.5-35.el6.x86_64.rpm
gfs2-utils-3.0.12.1-59.el6.x86_64.rpm
libqb-0.16.0-2.el6.i686.rpm
libqb-0.16.0-2.el6.x86_64.rpm
libqb-devel-0.16.0-2.el6.i686.rpm
libqb-devel-0.16.0-2.el6.x86_64.rpm
luci-0.26.0-48.el6.x86_64.rpm
i386
clusterlib-3.0.12.1-59.el6.i686.rpm
clusterlib-devel-3.0.12.1-59.el6.i686.rpm
cman-3.0.12.1-59.el6.i686.rpm
corosync-1.4.1-17.el6.i686.rpm
corosynclib-1.4.1-17.el6.i686.rpm
corosynclib-devel-1.4.1-17.el6.i686.rpm
fence-agents-3.1.5-35.el6.i686.rpm
gfs2-utils-3.0.12.1-59.el6.i686.rpm
libqb-0.16.0-2.el6.i686.rpm
libqb-devel-0.16.0-2.el6.i686.rpm
luci-0.26.0-48.el6.i686.rpm
- Scientific Linux Development Team
|
