PT-2023-29364 · Galleon · Galeon

Chess Hazlett · Published 2023-12-05 · Updated 2024-02-14 · CVE-2023-4503

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Galleon (affected versions not specified)

Description An improper initialization issue was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This could allow an attacker to access remote HTTP services available from the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2023-4503

RHSA-2023:7637

RHSA-2023:7638

RHSA-2023:7639

RHSA-2024:3580

RHSA-2024:3581

Affected Products

Galeon

References · 12

• https://access.redhat.com/errata/RHSA-2023:7638 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4503 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4503 · Security Note
• https://access.redhat.com/errata/RHSA-2023:7641 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-4503 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7639 · Vendor Advisory
• https://t.me/cvenotify/70181 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1732178053369872807 · Twitter Post
• https://t.me/cvenotify/71363 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2184751 · Note
• https://twitter.com/CVEnew/status/1754790206937674148 · Twitter Post