Aller au contenu
en Se connecter
Non notée

CVE-2021-3469 Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw

Description

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.

Produits et versions touchés

Produit Versions touchées Corrigé en
foreman Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de foreman

Les 8 CVE de foreman →
CVE-2022-3874 A command injection flaw was found in foreman 8.0 Élevée CVE-2023-0462 An arbitrary code execution flaw was found in Foreman 8.0 Élevée CVE-2021-20260 A flaw was found in the Foreman project Non notée CVE-2021-3590 A flaw was found in Foreman project Non notée
Suivre cette CVE