CVE-2010-2496 describes a vulnerability in stonith-ng within Pacemaker and cluster-glue where passwords were exposed as command-line parameters, allowing local attackers to access sensitive HA stack credentials. This medium-severity flaw (CVSS 5.5) has a low attack complexity and requires local access, potentially leading to unauthorized information disclosure. While no active exploitation, public exploit code, or significant community discussion has been observed, patches are available in cluster-glue 1.0.6+ and Pacemaker 1.1.3+.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.0.6CPE matchmatch criteria | cpe:2.3:a:clusterlabs:cluster_glue:*:*:*:*:*:*:*:* | ||
< 1.1.3CPE matchmatch criteria | cpe:2.3:a:clusterlabs:pacemaker:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.