CVE-2020-25654

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	pacemaker	pacemaker 1.1.24-rc1, pacemaker 2.0.5-rc2

References

https://bugzilla.redhat.com/show_bug.cgi?id=1888191Issue Tracking, Third Party Advisory
https://lists.clusterlabs.org/pipermail/users/2020-October/027840.htmlMailing List, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00007.htmlMailing List, Third Party Advisory
https://seclists.org/oss-sec/2020/q4/83Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202309-09
https://bugzilla.redhat.com/show_bug.cgi?id=1888191Issue Tracking, Third Party Advisory
https://lists.clusterlabs.org/pipermail/users/2020-October/027840.htmlMailing List, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00007.htmlMailing List, Third Party Advisory
https://seclists.org/oss-sec/2020/q4/83Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202309-09

Timeline

Published: Nov 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-256556.5An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views CVE-2020-256564.1A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. CVE-2020-256575.9A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API CVE-2020-256585.9It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to dec CVE-2020-256595.9python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 CVE-2020-25664.7Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Supported vers CVE-2020-256608.8A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients co CVE-2020-256618.8A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A CVE-2020-256626.5A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initializa CVE-2020-256635.5A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-CVE-2020-256646.1In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds CVE-2020-256655.5The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be of