CVE-2019-3885

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-18 · updated 2026-06-17
Weakness: CWE-416

Description

A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs.

Affected products

Canonical Ubuntu Linux: 16.04, 18.04, 18.10, 19.04
ClusterLabs pacemaker: through 2.0.1
Fedoraproject Fedora: 30

References

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00034.html
http://www.securityfocus.com/bid/108036
https://access.redhat.com/errata/RHSA-2019:1278
https://access.redhat.com/errata/RHSA-2019:1279
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3885
https://github.com/ClusterLabs/pacemaker/pull/1749
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GCWFO7GL6MBU6C4BGFO3P6L77DIBBF3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FY4M4RMIG2POKC6OOFQODGKPRYXHET2F/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HR6QUYGML735EI3HEEHYRDW7EG73BUH2/
https://security.gentoo.org/glsa/202309-09
https://usn.ubuntu.com/3952-1/
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00034.html

Get alerted when CVE-2019-3885 or the next vulnerability affects your stack