PT-2023-1956 · Foreman+1 · Foreman+1

Ybuenos · Published 2023-03-22 · Updated 2025-03-26 · CVE-2023-0462

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foreman (affected versions not specified)

Description An arbitrary code execution flaw was found in Foreman, related to incorrect handling of code generation in the YAML.load() function of the YAML parser library. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALT-PU-2025-3716

BDU:2023-01569

CVE-2023-0462

RHSA-2023:5931

RHSA-2023:5979

RHSA-2023:5980

Affected Products

Alt Linux

Foreman

References · 14

• https://bdu.fstec.ru/vul/2023-01569 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-0462 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0462 · Vendor Advisory
• https://github.com/theforeman/foreman/pull/9660 · Note
• https://access.redhat.com/security/cve/CVE-2023-0462 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2162970 · Note
• https://twitter.com/resource_found/status/1750063018593980645 · Twitter Post
• https://projects.theforeman.org/issues/36219 · Note
• https://twitter.com/cracbot/status/1704737286884401502 · Twitter Post
• https://access.redhat.com/security/cve/cve-2023-0462 · Note
• https://twitter.com/DMFezzaReedCISA/status/1704529647742878150 · Twitter Post
• https://t.me/cvenotify/58484 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704542192734228666 · Twitter Post
• https://twitter.com/CVEnew/status/1704493969009250372 · Twitter Post