Wind River Support Network

HomeDefectsLIN1019-6748

Acknowledged

LIN1019-6748 : Security Advisory - crmsh - CVE-2020-35459

Created: Jun 17, 2021 Updated: Jun 22, 2021

Found In Version: 10.19.45.1

Severity: Standard

Applicable for: Wind River Linux LTS 19

Component/s: Userspace

Description

An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.

CREATE(Triage):(User=admin) [CVE-2020-35459|https://nvd.nist.gov/vuln/detail/CVE-2020-35459]