Synopsis: Moderate: pcs security, bug fix, and enhancement update Advisory ID: SLSA-2016:2596-2 Issue Date: 2016-11-03 CVE Numbers: CVE-2016-0720 CVE-2016-0721 -- The following packages have been upgraded to a newer upstream version: pcs (0.9.152). Security Fix(es): * A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing nodes. (CVE-2016-0720) * It was found that pcsd did not invalidate cookies on the server side when a user logged out. This could potentially allow an attacker to perform session fixation attacks on pcsd. (CVE-2016-0721) These issues were discovered by Martin Prpic (Red Hat Product Security). Additional Changes: -- SL7 x86_64 pcs-0.9.152-10.el7.x86_64.rpm pcs-debuginfo-0.9.152-10.el7.x86_64.rpm - Scientific Linux Development Team