Vulnerability CVE-2020-35459

Vulnerability Name:

CVE-2020-35459 (CCN-194617)

Assigned:

2020-12-14

Published:

2021-01-12

Updated:

2021-07-21

Summary:

An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.

CVSS v3 Severity:

7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-269

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2020-35459

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[oss-security] 20210112 Security issues in hawk2 and crmsh

Source: MISC
Type: Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1179999

Source: XF
Type: UNKNOWN
clusterlabs-cve202035459-priv-esc(194617)

Source: CCN
Type: crmsh GIT Repository
crmsh

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/ClusterLabs/crmsh/blob/a403aa15f3ea575adfe5e43bf2a31c9f9094fcda/crmsh/history.py#L476

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/ClusterLabs/crmsh/releases

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210125 [SECURITY] [DLA 2533-1] crmsh security update

Source: CCN
Type: oss-sec Mailing List, Tue, 12 Jan 2021 13:59:59 +0100
Security issues in hawk2 and crmsh

Source: CONFIRM
Type: Exploit, Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/01/12/3

Vulnerable Configuration:

Configuration 1:

cpe:/a:clusterlabs:crmsh:*:*:*:*:*:*:*:* (Version <= 4.2.1)

Configuration 2:

cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:6103	P	Security update for java-1_8_0-openjdk (Important)	2022-07-22
oval:org.opensuse.security:def:95326	P	Security update for netty3 (Moderate)	2022-06-13
oval:org.opensuse.security:def:102236	P	Security update for libslirp (Important)	2022-04-29
oval:org.opensuse.security:def:102241	P	Security update for apache2-mod_auth_mellon (Moderate) (in QA)	2022-04-06
oval:org.opensuse.security:def:102039	P	Security update for the Linux Kernel (Live Patch 14 for SLE 15 SP3) (Important)	2022-03-29
oval:org.opensuse.security:def:112116	P	crmsh-4.3.1+20210913.d7356663-1.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:105653	P	crmsh-4.3.1+20210913.d7356663-1.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:19567	P	Security update for crmsh (Important)	2021-09-16
oval:org.opensuse.security:def:19612	P	Security update for crmsh (Important)	2021-09-16
oval:org.opensuse.security:def:4280	P	Security update for crmsh (Important)	2021-09-16
oval:org.opensuse.security:def:125099	P	Security update for crmsh (Important)	2021-09-16
oval:org.opensuse.security:def:110987	P	Security update for crmsh (Moderate)	2021-07-24
oval:org.opensuse.security:def:75935	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:102864	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:67192	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:102290	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:8364	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:66867	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:109530	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:8388	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:108705	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:118626	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:111635	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:96174	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:76260	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:5778	P	Security update for crmsh (Moderate)	2021-07-21
oval:org.opensuse.security:def:8255	P	Security update for crmsh (Moderate)	2021-07-02
oval:org.opensuse.security:def:8322	P	Security update for crmsh (Moderate)	2021-07-02
oval:org.opensuse.security:def:98828	P	Security update for crmsh (Moderate)	2021-07-02
oval:org.opensuse.security:def:91878	P	Security update for crmsh (Moderate)	2021-07-02
oval:org.opensuse.security:def:111290	P	Security update for hawk2 (Important)	2021-03-25
oval:org.opensuse.security:def:102881	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:8335	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:98841	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:19527	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:8381	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:19577	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:109547	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:19625	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:4293	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:118643	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:96191	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:91891	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:125109	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:97339	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:8268	P	Security update for hawk2 (Important)	2021-03-24
oval:org.opensuse.security:def:5980	P	Security update for python3 (Moderate)	2021-03-19
oval:org.opensuse.security:def:8265	P	Security update for crmsh (Important)	2021-03-17
oval:org.opensuse.security:def:97292	P	Security update for crmsh (Important)	2021-03-17
oval:org.opensuse.security:def:111265	P	Security update for crmsh (Important)	2021-03-14
oval:org.opensuse.security:def:96188	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:97287	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:91888	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:5975	P	Security update for s390-tools (Important)	2021-03-12
oval:org.opensuse.security:def:95523	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:76132	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:97288	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:102878	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:8332	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:98838	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:8378	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:67064	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:109544	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:108902	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:118640	P	Security update for crmsh (Important)	2021-03-12
oval:org.opensuse.security:def:19524	P	Security update for crmsh (Important)	2021-03-11
oval:org.opensuse.security:def:125105	P	Security update for crmsh (Important)	2021-03-08
oval:org.opensuse.security:def:19573	P	Security update for crmsh (Important)	2021-03-08
oval:org.opensuse.security:def:19621	P	Security update for crmsh (Important)	2021-03-08
oval:org.opensuse.security:def:4289	P	Security update for crmsh (Important)	2021-03-08
oval:org.opensuse.security:def:110669	P	Security update for crmsh (Important)	2021-01-16
oval:org.opensuse.security:def:111318	P	Security update for crmsh (Important)	2021-01-13
oval:org.opensuse.security:def:109545	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:19623	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:66495	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:4291	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:108907	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:97315	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:118641	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:104857	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:96189	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:91889	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:125107	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:97326	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:95528	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:91202	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:76137	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:8266	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:5406	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:75563	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:102879	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:8333	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:98839	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:19525	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:8379	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:98167	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:97304	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:19575	P	Security update for crmsh (Important)	2021-01-12
oval:org.opensuse.security:def:67069	P	Security update for crmsh (Important)	2021-01-12

BACK