PT-2018-7165 · Foreman · Katello Plugin+1

Published 2018-08-22 · Updated 2023-02-12 · CVE-2017-2662

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Foreman's katello plugin version 3.4.5

Description: A flaw was found in Foreman's katello plugin. The issue occurs when a new role is set to allow restricted access on a repository with a filter, specifically a filter set on the Product Name. In this scenario, the filter is not respected when actions are performed via hammer using the repository id.

Recommendations: For Foreman's katello plugin version 3.4.5, consider restricting access to the repository id in hammer until a fix is available. As a temporary workaround, avoid using the repository id in hammer for actions related to repositories with filters set on the Product Name.

Fix

Missing Authorization

Improper Privilege Management

Weakness Enumeration

CWE-862

CWE-269

Related Identifiers

CVE-2017-2662

GHSA-CPV6-PFQ6-J2V7

RHSA-2021:1313

Affected Products

Foreman

Katello Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-2662 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2662 · Vendor Advisory
• https://projects.theforeman.org/issues/18838 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpv6-pfq6-j2v7 · Vendor Advisory
• https://github.com/Katello/katello · Note
• https://github.com/Katello/katello/pull/8772 · Note
• https://github.com/Katello/katello/commit/853260e3e9f94179d5881199e7885d1c08e600f6 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662 · Note