9.8 - CVE-2023-2319

Executive Summary

Informations
Name	CVE-2023-2319	First vendor Publication	2023-05-17
Vendor	Cve	Last vendor Modification	2023-05-26

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score	9.8
Base Score	9.8	Environmental Score	9.8
impact SubScore	5.9	Temporal Score	9.8
Exploitabality Sub Score	3.9

Attack Vector	Network	Attack Complexity	Low
Privileges Required	None	User Interaction	None
Scope	Unchanged	Confidentiality Impact	High
Integrity Impact	High	Availability Impact	High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2319

CPE : Common Platform Enumeration

Type	Description	Count
Application	Clusterlabs Pcs cpe:2.3:a:clusterlabs:pcs:0.11.4-6.el9:::::::*	1
Os	Redhat Enterprise Linux High Availability cpe:2.3:o:redhat:enterprise_linux_high_availability:9.0:::::::*	1
Os	Redhat Enterprise Linux High Availability Eus cpe:2.3:o:redhat:enterprise_linux_high_availability_eus:9.2:::::::*	1

Sources (Detail)

Source	Url
MISC	https://access.redhat.com/errata/RHSA-2023:2652 https://access.redhat.com/security/cve/CVE-2023-2319 https://bugzilla.redhat.com/show_bug.cgi?id=2190092