ALT-PU-2025-2399-1

Package update foreman in branch sisyphus

Version3.13.0-alt1

Published2025-02-05

Max severityCRITICAL

Severity:

Closed issues (4)

HIGH8.0

Уязвимость функции YAML.load() библиотеки синтаксического анализатора YAML приложения для управления, настройки и мониторинга сервера Foreman и программного средства для управления системами Red Hat Satellite, позволяющая нарушителю выполнить произвольный код

Published: 2023-03-27

CVSS 3.xHIGH 8.0

CVSS:3.x/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS 2.0HIGH 7.1

CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:C/A:C

References

CVE-2023-0462

CRITICAL9.1

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

Published: 2023-09-20Modified: 2024-11-21

CVSS 3.xCRITICAL 9.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

MEDIUM4.4

A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.

Published: 2023-10-03Modified: 2024-11-21

CVSS 3.xMEDIUM 4.4

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

MEDIUM6.3

A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information.

Published: 2024-10-31Modified: 2026-04-15

CVSS 3.xMEDIUM 6.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References