PT-2015-4022 · Red Hat · Spacewalk+1

Published 2015-05-14 · Updated 2023-02-13 · CVE-2014-8162

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Network Satellite versions 5.7 and earlier Spacewalk versions 5.7 and earlier

Description The issue is related to an XML external entity (XXE) in the RPC interface. This allows remote attackers to read arbitrary files and possibly have other unspecified impact.

Recommendations For Red Hat Network Satellite versions 5.7 and earlier, update to a version later than 5.7. For Spacewalk versions 5.7 and earlier, update to a version later than 5.7. As a temporary workaround, consider restricting access to the RPC interface until a patch is available.

Fix

Related Identifiers

CVE-2014-8162

RHSA-2015:0957

Affected Products

Red Hat Network Satellite

Spacewalk

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-8162 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00020.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0957.html · Vendor Advisory
• http://securityfocus.com/bid/74595 · Note