View at Official debian advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2010-2496 not yet assigned priority: Debian including 2 source packages (cluster-glue, pacemaker), 10 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 10.
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.