MediumFix available
cluster-glue, pacemaker — security advisory
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
- Products
- cluster-glue, pacemaker
- Affected versions
- Not specified
- Fixed versions
- 1.0.6-1, 1.1.13-1
- CVEs
- CVE-2010-2496
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:00 UTC · Revision 1
Source evidence
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
osv:DEBIAN-CVE-2010-2496
cluster-glue
Fixed versions: 1.0.6-1
cluster-glue
Fixed versions: 1.0.6-1
cluster-glue
Fixed versions: 1.0.6-1
pacemaker
Fixed versions: 1.1.13-1
pacemaker
Fixed versions: 1.1.13-1
pacemaker
Fixed versions: 1.1.13-1
Complete source record
{
"id": "b37a58f62b7cfe3d82ae1e59d534df01107e258c508a8214d1172401f7a95a3f",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2010-2496",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2010-2496",
"summary": "stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.",
"evidence": "osv:DEBIAN-CVE-2010-2496",
"products": [
{
"name": {
"value": "cluster-glue",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.0.6-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "cluster-glue",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.0.6-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "cluster-glue",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.0.6-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pacemaker",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.1.13-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pacemaker",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.1.13-1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pacemaker",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.1.13-1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2010-2496",
"aliases": [
"DEBIAN-CVE-2010-2496"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.6-1"
}
]
}
],
"package": {
"name": "cluster-glue",
"purl": "pkg:deb/debian/cluster-glue?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-2496.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.6-1"
}
]
}
],
"package": {
"name": "cluster-glue",
"purl": "pkg:deb/debian/cluster-glue?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-2496.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.6-1"
}
]
}
],
"package": {
"name": "cluster-glue",
"purl": "pkg:deb/debian/cluster-glue?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-2496.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.13-1"
}
]
}
],
"package": {
"name": "pacemaker",
"purl": "pkg:deb/debian/pacemaker?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-2496.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.13-1"
}
]
}
],
"package": {
"name": "pacemaker",
"purl": "pkg:deb/debian/pacemaker?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-2496.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.13-1"
}
]
}
],
"package": {
"name": "pacemaker",
"purl": "pkg:deb/debian/pacemaker?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-2496.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T18:02:42.808927627Z",
"provider": "osv",
"upstream": [
"CVE-2010-2496"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2010-2496"
]
},
"related_cves": [
{
"value": "CVE-2010-2496",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 419653,
"published_at": "2021-10-18T13:15:08.927+00:00"
}