An update for pcs is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2022-1886 Final 1.0 1.0 2022-09-02 Initial 2022-09-02 2022-09-02 openEuler SA Tool V1.0 2022-09-02 pcs security update An update for pcs is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS. pcs is a corosync and pacemaker configuration tool. It permits users to easily view, modify and create pacemaker based clusters. Security Fix(es): A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.(CVE-2022-1049) An update for pcs is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High pcs https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1886 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-1049 https://nvd.nist.gov/vuln/detail/CVE-2022-1049 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS pcs-0.10.5-2.oe1.aarch64.rpm pcs-snmp-0.10.5-2.oe1.aarch64.rpm pcs-0.10.5-2.oe1.aarch64.rpm pcs-snmp-0.10.5-2.oe1.aarch64.rpm pcs-0.10.8-3.oe2203.aarch64.rpm pcs-snmp-0.10.8-3.oe2203.aarch64.rpm pcs-0.10.5-2.oe1.src.rpm pcs-0.10.5-2.oe1.src.rpm pcs-0.10.8-3.oe2203.src.rpm pcs-snmp-0.10.5-2.oe1.x86_64.rpm pcs-0.10.5-2.oe1.x86_64.rpm pcs-snmp-0.10.5-2.oe1.x86_64.rpm pcs-0.10.5-2.oe1.x86_64.rpm pcs-snmp-0.10.8-3.oe2203.x86_64.rpm pcs-0.10.8-3.oe2203.x86_64.rpm A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login. 2022-09-02 CVE-2022-1049 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS High 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H pcs security update 2022-09-02 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1886