Vulnerability · Published May 17, 2023 · Assigned by redhat
CVE-2023-2319
Critical 9.8
In plain English
A critical-severity security flaw in pcs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | pcs | 0.11.4-7.el9_2 | ALSA-2023:2652 |
| AlmaLinux:9 | pcs-snmp | 0.11.4-7.el9_2 | ALSA-2023:2652 |
| Rocky Linux:9 | pcs | 0:0.11.4-7.el9_2 | RLSA-2023:2652 |