PT-2023-1956 · Foreman+1 · Foreman+1

Ybuenos · Publicado 2023-03-22 · Atualizado 2025-03-26 · CVE-2023-0462

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foreman (affected versions not specified)

Description An arbitrary code execution flaw was found in Foreman, related to incorrect handling of code generation in the YAML.load() function of the YAML parser library. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

ALT-PU-2025-3716

BDU:2023-01569

CVE-2023-0462

RHSA-2023:5931

RHSA-2023:5979

RHSA-2023:5980

Produtos afetados

Alt Linux

Foreman

Referências · 14

• https://github.com/theforeman/foreman/pull/9660 · Nota
• https://access.redhat.com/security/cve/CVE-2023-0462 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2162970 · Nota
• https://twitter.com/resource_found/status/1750063018593980645 · Publicação no Twitter
• https://projects.theforeman.org/issues/36219 · Nota
• https://twitter.com/cracbot/status/1704737286884401502 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-01569 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2023-0462 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-0462 · Nota de Segurança
• https://twitter.com/DMFezzaReedCISA/status/1704529647742878150 · Publicação no Twitter
• https://t.me/cvenotify/58484 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1704542192734228666 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-0462 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1704493969009250372 · Publicação no Twitter