Security update for crmsh SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0084-1 Final 1 1 2021-01-12T13:32:13Z current 2021-01-12T13:32:13Z 2021-01-12T13:32:13Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for crmsh This update for crmsh fixes the following issue: - CVE-2020-35459: Fixed a privilege escalation in hawk_invoke (bsc#1179999). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-84,SUSE-SLE-HA-12-SP3-2021-84 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210084-1/ Link for SUSE-SU-2021:0084-1 https://lists.suse.com/pipermail/sle-security-updates/2021-January/008180.html E-Mail link for SUSE-SU-2021:0084-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1179999 SUSE Bug 1179999 https://www.suse.com/security/cve/CVE-2020-35459/ SUSE CVE CVE-2020-35459 page SUSE Linux Enterprise High Availability Extension 12 SP3 crmsh-3.0.4+git.1607490926.e492f845-13.56.1 crmsh-scripts-3.0.4+git.1607490926.e492f845-13.56.1 crmsh-test-3.0.4+git.1607490926.e492f845-13.56.1 crmsh-3.0.4+git.1607490926.e492f845-13.56.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP3 crmsh-scripts-3.0.4+git.1607490926.e492f845-13.56.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP3 An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges. CVE-2020-35459 SUSE Linux Enterprise High Availability Extension 12 SP3:crmsh-3.0.4+git.1607490926.e492f845-13.56.1 SUSE Linux Enterprise High Availability Extension 12 SP3:crmsh-scripts-3.0.4+git.1607490926.e492f845-13.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210084-1/ https://www.suse.com/security/cve/CVE-2020-35459.html CVE-2020-35459 https://bugzilla.suse.com/1179999 SUSE Bug 1179999