CVE-2021-3020
Summary
| CVE | CVE-2021-3020 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-08-26 00:15:00 UTC |
|---|
| Updated | 2023-08-08 14:22:00 UTC |
|---|
| Description | An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Clusterlabs |
Hawk |
All |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Access Denied |
MISC |
bugzilla.suse.com |
|
| Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35… · ClusterLabs/crmsh@c538024 · GitHub |
MISC |
github.com |
|
| Releases · ClusterLabs/hawk · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 750318 OpenSUSE Security Update for crmsh (openSUSE-SU-2021:0410-1)
