Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-5993ffa09a advisory.

    - Fix displaying differences between configuration checkpoints in pcs config checkpoint diff command
    - Fix pcs stonith update-scsi-devices command which was broken since Pacemaker-2.1.5-rc1
    - Fixed loading of cluster status in the web interface when fencing levels are configured
    - Fixed a vulnerability in pcs-web-ui-node-modules
    - Swapped BuildRequires: npm for BuildRequires: nodejs-npm in Fedora 37 because of NodeJS packaging change
    - Removed BuildRequires: rubygem-io-console
    - Removed dependency rubygem-eventmachine

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4d546e6b4b advisory.

    - Fix displaying differences between configuration checkpoints in pcs config checkpoint diff command
    - Fix pcs stonith update-scsi-devices command which was broken since Pacemaker-2.1.5-rc1
    - Fixed loading of cluster status in the web interface when fencing levels are configured
    - Fixed a vulnerability in pcs-web-ui-node-modules
    - Swapped BuildRequires: npm for BuildRequires: nodejs-npm in Fedora 37 because of NodeJS packaging change
    - Removed BuildRequires: rubygem-io-console
    - Removed dependency rubygem-eventmachine


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-cb2e422088 advisory.

    - Fix displaying differences between configuration checkpoints in pcs config checkpoint diff command
    - Fix pcs stonith update-scsi-devices command which was broken since Pacemaker-2.1.5-rc1
    - Fixed loading of cluster status in the web interface when fencing levels are configured
    - Fixed a vulnerability in pcs-web-ui-node-modules
    - Swapped BuildRequires: npm for BuildRequires: nodejs-npm in Fedora 37 because of NodeJS packaging change
    - Removed BuildRequires: rubygem-io-console
    - Removed dependency rubygem-eventmachine


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:1591 advisory.

  - Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the     magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the     real global object. (CVE-2023-28154)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12235 advisory.

    [0.11.3-4.el9_1.3]
    - Fixed a vulnerability in pcs-web-ui-node-modules
    - Resolves: rhbz#2179900

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:1591 advisory.

  - Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the     magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the     real global object. (CVE-2023-28154)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1591 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * webpack: avoid cross-realm objects (CVE-2023-28154)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
174652	Fedora 36 : pcs (2023-5993ffa09a)	Nessus	Fedora Local Security Checks	critical
174634	Fedora 38 : pcs (2023-4d546e6b4b)	Nessus	Fedora Local Security Checks	critical
174632	Fedora 37 : pcs (2023-cb2e422088)	Nessus	Fedora Local Security Checks	critical
173988	Rocky Linux 9 : pcs (RLSA-2023:1591)	Nessus	Rocky Linux Local Security Checks	critical
173974	Oracle Linux 9 : pcs (ELSA-2023-12235)	Nessus	Oracle Linux Local Security Checks	critical
173907	AlmaLinux 9 : pcs (ALSA-2023:1591)	Nessus	Alma Linux Local Security Checks	critical
173847	RHEL 9 : pcs (RHSA-2023:1591)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2023-28154

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical