9.8
Critique
CVE-2024-7923 An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to…
Description
An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Satellite 6.13 for RHEL 8 | Versions non publiées | |
| Red Hat Satellite 6.14 for RHEL 8 | Versions non publiées | |
| Red Hat Satellite 6.15 for RHEL 8 | Versions non publiées | |
| Red Hat Satellite 6.16 for RHEL 8 | Versions non publiées | |
| Red Hat Satellite 6.16 for RHEL 9 | Versions non publiées | |
| Red Hat Update Infrastructure 4 for Cloud Providers | Versions non publiées |
Références
- RHSA-2024:6335 access.redhat.com
- RHSA-2024:6336 access.redhat.com
- RHSA-2024:6337 access.redhat.com
- RHSA-2024:8906 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2305718 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Satellite 6.13 for RHEL 8
Les 6 CVE de Red Hat Satellite 6.13 for RHEL 8 →
CVE-2024-8553
A vulnerability was found in Foreman's loader macros introduced with report templates
6.3
Moyenne
CVE-2024-7012
An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to…
9.8
Critique
CVE-2023-4886
A sensitive information exposure vulnerability was found in foreman
6.7
Moyenne
CVE-2023-0118
An arbitrary code execution flaw was found in Foreman
9.1
Critique