{
  "cveId": "CVE-2020-35459",
  "url": "https://patchblox.com/security/cve/CVE-2020-35459",
  "summary": "CVE-2020-35459 is fixed in crmsh on 1 platform, first by crmsh 4.2.0-2ubuntu1.1, released January 12, 2021. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "crmsh: An issue was discovered in ClusterLabs crmsh through 4.2.1",
  "description": "An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackersable to call \u0022crm history\u0022 (when \u0022crm\u0022 is run) were able to executecommands via shell code injection to the crm history commandline,potentially allowing escalation of privileges.",
  "published": "2021-01-12T04:00:00Z",
  "severity": "Low",
  "epss": 0.00689,
  "epssPercentile": 0.53001,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "crmsh",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "4.2.0-2ubuntu1.1",
      "fix": "crmsh 4.2.0-2ubuntu1.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-crmsh-4.2.0-2ubuntu1.1",
      "released": "2021-01-12T04:00:00Z"
    },
    {
      "platform": "linux",
      "product": "crmsh",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "4.2.1-2",
      "fix": "crmsh 4.2.1-2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-crmsh-4.2.1-2",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "crmsh",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "4.2.1-2",
      "fix": "crmsh 4.2.1-2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-crmsh-4.2.1-2",
      "released": "2026-01-16T01:42:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}