Yadnyawalk Tale

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** A flaw was found in the Foreman project, specifically in the Datacenter plugin, which exposes the password through the API to an authenticated local attacker with view hosts permission. This poses a significant threat to data confidentiality and integrity, as well as system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman project (affected versions not specified) **Description** A flaw was found in the Foreman project, where a credential leak exposes the Azure Compute Profile password through JSON of the API output. The highest threat from this issue is to data confidentiality and integrity as well as system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Red Hat Satellite (affected versions not specified) **Description** The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** An issue with improper authorization handling was discovered, allowing authenticated local attackers to access and delete limited resources, and causing a denial of service on the server. The primary threats posed by this issue are to system integrity and availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** An improper authorization handling flaw was found, allowing an authenticated local attacker to access and delete limited resources, and also causing a denial of service on the server. The highest threat from this issue is to integrity and system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman Ansible (affected versions not specified) **Description** An authorization flaw was found, allowing an authenticated attacker with certain permissions to create and run Ansible jobs to access hosts through job templates. This poses a threat to data confidentiality and integrity, as well as system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: foreman fog proxmox versions prior to 0.13.1 Description: A flaw was found in the Foreman project, where the Proxmox compute resource exposes the password through the API to an authenticated local attacker with view hosts permission. This poses a significant threat to data confidentiality and integrity, as well as system availability. Recommendations: For versions prior to 0.13.1, update to version 0.13.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Proxmox compute resource API for authenticated local attackers with view hosts permission until a patch is available.

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 2.3.4 Foreman versions prior to 2.4.0 Description: The issue is related to improper authorization handling. An authenticated attacker can exploit this to impersonate the foreman-proxy if the product is configured to enable the Puppet Certificate Authority (CA) to sign certificate requests with subject alternative names (SANs). By default, Foreman does not enable SANs, and the `allow-authorization-extensions` setting is `false` unless the user explicitly changes the `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration. Recommendations: For Foreman versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue. For Foreman versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider disabling the Puppet Certificate Authority (CA) from signing certificate requests with subject alternative names (SANs) by ensuring `allow-authorization-extensions` is set to `false` in the `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration.

Name of the Vulnerable Software and Affected Versions: Foreman (affected versions not specified) Description: An improper authorization handling flaw was found in Foreman, specifically in the Shellhooks plugin for the smart-proxy. This allows Foreman clients to execute actions that should be limited to the Foreman Server, enabling an authenticated local attacker to access and delete limited resources. The flaw also causes a denial of service on the Foreman server, with the highest threat being to integrity and system availability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 2.5.0 Description: A flaw in the smart proxy of Foreman, which provides a restful API to various sub-systems, can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, allowing an unauthenticated attacker to perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. Recommendations: For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the FreeIPA module of the Foreman smart proxy to minimize the risk of exploitation. Avoid using the smart proxy's restful API for sensitive operations until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite tfm-rubygem-foreman azure rm versions prior to 2.2.0 Description: A flaw in Red Hat Satellite's tfm-rubygem-foreman azure rm component can lead to a credential leak, exposing Azure Resource Manager's secret key through JSON in the API output. This issue primarily threatens data confidentiality and integrity, as well as system availability. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the API output to minimize the risk of credential exposure.

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite (affected versions not specified) Description: A flaw was found in Red Hat Satellite, where the BMC interface exposes the password through the API to an authenticated local attacker with view hosts permission. This poses a significant threat to data confidentiality and integrity, as well as system availability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite (affected versions not specified) Description: A credential leak issue was discovered, which exposes compute resources credentials through VMs running on these resources in Satellite. This flaw may allow a remote attacker to gain unauthorized access to protected information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Red Hat CloudForms versions prior to 5.11.7.0 **Description** The issue is related to an authorization flaw that allows a malicious attacker to create existing and non-existing role-based access control users, with groups and roles. This can enable an attacker to perform any API request as a super administrator by selecting a specific group, such as EvmGroup-super administrator. The flaw is associated with errors in authorization. **Recommendations** For versions prior to 5.11.7.0, update to version 5.11.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the EvmGroup-super administrator group to minimize the risk of exploitation. Additionally, restrict API requests to only necessary users and groups to reduce the potential impact of the flaw.

**Name of the Vulnerable Software and Affected Versions** Red Hat Satellite 6 **Description** The issue is related to inadequate access control in Red Hat Satellite, allowing a privileged attacker to read cache files. These cache credentials could help the attacker gain complete control of the Satellite instance. **Recommendations** For Red Hat Satellite 6, consider restricting access to cache files as a temporary workaround until a patch is available. Additionally, review and limit privileged access to the Satellite instance to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.