CVE-2020-35459

An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.

• CWE-78

• http://www.openwall.com/lists/oss-security/2021/01/12/3Mailing List, Patch, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1179999Issue Tracking, Third Party Advisory
• https://github.com/ClusterLabs/crmsh/blob/a403aa15f3ea575adfe5e43bf2a31c9f9094fcda/crmsh/history.py#L476Patch, Third Party Advisory
• https://github.com/ClusterLabs/crmsh/releasesRelease Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/01/msg00021.htmlMailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2021/01/12/3Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/01/12/3Mailing List, Patch, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1179999Issue Tracking, Third Party Advisory
• https://github.com/ClusterLabs/crmsh/blob/a403aa15f3ea575adfe5e43bf2a31c9f9094fcda/crmsh/history.py#L476Patch, Third Party Advisory
• https://github.com/ClusterLabs/crmsh/releasesRelease Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/01/msg00021.htmlMailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2021/01/12/3Exploit, Mailing List, Third Party Advisory

Published

Jan 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35453HashiCorp Vault Enterprise’s Sentinel EGP policy feature inc…5.3
• CVE-2020-35454The Taidii Diibear Android application 2.4.0 and all its der…6.8
• CVE-2020-35455The Taidii Diibear Android application 2.4.0 and all its der…7.8
• CVE-2020-35456The Taidii Diibear Android application 2.4.0 and all its der…5.5
• CVE-2020-35457GNOME GLib before 2.65.3 has an integer overflow, that might…7.8
• CVE-2020-35458An issue was discovered in ClusterLabs Hawk 2.x through 2.3.…9.8
• CVE-2020-3546A vulnerability in the web-based management interface of Cis…5.3
• CVE-2020-35460common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 …5.3
• CVE-2020-35462Version 3.16.0 of the CoScale agent Docker image contains a …9.8
• CVE-2020-35463Version 1.0.0 of the Instana Dynamic APM Docker image contai…9.8
• CVE-2020-35464Version 1.3.0 of the Weave Cloud Agent Docker image contains…9.8
• CVE-2020-35465Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…