Red Hat Enterprise Linux High Availability vulnerabilities

4 CVEs affecting Red Hat Enterprise Linux High Availability, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-2319, published 2023-05-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-7797, published 2017-03-24. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
CVE-2015-1867, published 2015-08-12. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
CVE-2015-1848, published 2015-05-14. Medium severity, CVSS 6.8. EPSS: 2.4% chance of exploitation in the next 30 days. The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its…
CVE-2023-2319, published 2023-05-17. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS…