9.8
Critical
CVE-2024-7012 An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to…
Description
An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Satellite 6.13 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.14 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.15 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 9 | Versions not published |
References
- RHSA-2024:6335 access.redhat.com
- RHSA-2024:6336 access.redhat.com
- RHSA-2024:6337 access.redhat.com
- RHSA-2024:8906 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2299429 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Satellite 6.13 for RHEL 8
The 6 CVEs of Red Hat Satellite 6.13 for RHEL 8 →
CVE-2024-8553
A vulnerability was found in Foreman's loader macros introduced with report templates
6.3
Medium
CVE-2024-7923
An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to…
9.8
Critical
CVE-2023-4886
A sensitive information exposure vulnerability was found in foreman
6.7
Medium
CVE-2023-0118
An arbitrary code execution flaw was found in Foreman
9.1
Critical