Red Hat Satellite 6.3

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

Published: 2019-04-23T15:57:07.000Z
Updated: 2024-08-04T17:44:15.919Z

A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.

Published: 2018-06-21T13:00:00.000Z
Updated: 2024-08-05T14:02:07.221Z

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.

Published: 2018-03-12T15:00:00.000Z
Updated: 2024-08-05T14:02:07.434Z

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

Published: 2018-07-27T18:00:00.000Z
Updated: 2024-08-06T02:59:02.231Z

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.

Published: 2018-08-01T13:00:00.000Z
Updated: 2024-08-06T02:27:41.125Z