Pacemaker vulnerabilities

Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.

Pacemaker before version 1.1.13 does not properly evaluate added nodes, allowing remote read-only users to gain privileges via an acl command.

A flaw was found in Pacemaker where an unauthenticated remote attacker can exploit an integer overflow in the remote message decompression process. By sending a specially crafted compressed message before authentication, an attacker can cause memory corruption, leading to denial of service (DoS) in the CIB remote listener.