Bug 2066629 (CVE-2022-1049) - CVE-2022-1049 pcs: improper authentication via PAM
Summary: CVE-2022-1049 pcs: improper authentication via PAM
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-1049
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2068452 2068456 2068457
Blocks: 2063741 2066708
TreeView+ depends on / blocked
 
Reported: 2022-03-22 08:22 UTC by TEJ RATHI
Modified: 2022-12-04 18:20 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon allowed expired accounts and accounts with expired passwords to log in when using PAM authentication. Unprivileged, expired accounts with previously denied access could still log in.
Clone Of:
Environment:
Last Closed: 2022-12-04 18:20:37 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:7447 0 None None None 2022-11-08 09:10:39 UTC
Red Hat Product Errata RHSA-2022:7935 0 None None None 2022-11-15 09:45:54 UTC

Description TEJ RATHI 2022-03-22 08:22:04 UTC 
Pacemakers daemon pcsd allows authentication via PAMs pam_authenticate. Unfortunately the authorization via pam_acct_mgmt has been omitted. Therefore unprivileged expired accounts that have been denied access can still login.

References:
https://huntr.dev/bounties/7aa921fc-a568-4fd8-96f4-7cd826246aa5/
https://github.com/ClusterLabs/pcs/commit/fb860005117dc9e092649687dfa1304fb423efc5
Comment 1 Mauro Matteo Cascella 2022-03-25 11:16:18 UTC 
Created pcs tracking bugs for this issue:

Affects: fedora-all [bug 2068452]
Comment 3 errata-xmlrpc 2022-11-08 09:10:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7447 https://access.redhat.com/errata/RHSA-2022:7447
Comment 4 errata-xmlrpc 2022-11-15 09:45:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7935 https://access.redhat.com/errata/RHSA-2022:7935
Comment 5 Product Security DevOps Team 2022-12-04 18:20:35 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-1049
Note You need to log in before you can comment on or make changes to this bug.