CVE-2022-1049: 
Alma Linux vulnerability analysis and mitigation

CVE-2022-1049 is a security vulnerability discovered in the Pacemaker configuration tool (pcs). The vulnerability allows expired accounts and accounts with expired passwords to log in when using PAM authentication, potentially enabling unauthorized access to the system (Red Hat Portal, NVD).

The vulnerability exists in the pcs daemon's authentication mechanism where it improperly handles PAM authentication for expired accounts. This flaw specifically affects the authentication process, allowing unprivileged expired accounts that should have been denied access to still successfully log in to the system (Debian Security).

The vulnerability could allow unauthorized access to the system by users whose accounts have expired or whose passwords have expired, potentially compromising system security by bypassing intended access restrictions (Red Hat Portal).

The vulnerability has been fixed in multiple versions across different distributions. For Debian 10 (buster), the fix is available in version 0.10.1-2+deb10u1, and for Debian 11 (bullseye), in version 0.10.8-1+deb11u1. Red Hat has addressed this issue in pcs version 0.10.14-5.el8 (Debian LTS, Red Hat Advisory).