PT-2018-7165 · Foreman · Foreman+1

CVE-2017-2662 · Publicado 2018-08-22 · Atualizado 2023-02-12

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Foreman's katello plugin version 3.4.5

Description: A flaw was found in Foreman's katello plugin. The issue occurs when a new role is set to allow restricted access on a repository with a filter, specifically a filter set on the Product Name. In this scenario, the filter is not respected when actions are performed via hammer using the repository id.

Recommendations: For Foreman's katello plugin version 3.4.5, consider restricting access to the repository id in hammer until a fix is available. As a temporary workaround, avoid using the repository id in hammer for actions related to repositories with filters set on the Product Name.

Correção

Missing Authorization

Improper Privilege Management

Enumeração de Fraquezas

CWE-862

CWE-269

Identificadores relacionados

CVE-2017-2662

GHSA-CPV6-PFQ6-J2V7

RHSA-2021:1313

Produtos afetados

Foreman

Katello Plugin

Referências · 8

• https://github.com/Katello/katello · Nota
• https://github.com/Katello/katello/commit/853260e3e9f94179d5881199e7885d1c08e600f6 · Nota
• https://github.com/Katello/katello/pull/8772 · Nota
• https://osv.dev/vulnerability/CVE-2017-2662 · Aviso do Fabricante
• https://projects.theforeman.org/issues/18838 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662 · Nota
• https://osv.dev/vulnerability/GHSA-cpv6-pfq6-j2v7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2662 · Nota de Segurança