Skip to content
Sign in
Not rated

CVE-2021-3469 Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw

Description

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.

Affected products and versions

Product Affected versions Fixed in
foreman Versions not published

Other CVEs of foreman

The 8 CVEs of foreman →
CVE-2022-3874 A command injection flaw was found in foreman 8.0 High CVE-2023-0462 An arbitrary code execution flaw was found in Foreman 8.0 High CVE-2021-20260 A flaw was found in the Foreman project Not rated CVE-2021-3590 A flaw was found in Foreman project Not rated
Track this CVE