Evgeni Golov

توجد ثغرة أمنية في foreman kubevirt تتعلق بالتحقق من SSL عند الاتصال بـ OpenShift. بشكل افتراضي، يقوم النظام بتعطيل التحقق من SSL في حالة عدم توفير شهادة من جهة إصدار الشهادات (CA). تسمح هذه الإعدادات لمهاجم عن بُعد، قادر على اعتراض حركة مرور الشبكة بين Satellite و OpenShift، بتنفيذ هجوم «الرجل في الوسط» (MITM)، مما قد يؤدي إلى الكشف عن المعلومات الحساسة أو تغييرها.

يوجد ثغرة أمنية في fog-kubevirt تسمح لمهاجم عن بُعد بتنفيذ هجوم «الرجل في الوسط» (MITM). ويرجع ذلك إلى تعطيل عملية التحقق من صحة الشهادات، مما يسمح للمهاجم باعتراض الاتصالات الحساسة بين Satellite و OpenShift وربما تعديلها. وقد يؤدي ذلك إلى تسرب المعلومات وتهديد سلامة البيانات. يتضمن هجوم MITM قيام المهاجم بإعادة إرسال الاتصالات سراً وربما تغييرها بين طرفين يعتقدان أنهما يتواصلان مباشرةً مع بعضهما البعض.

A flaw was found in the Foreman project, specifically in the Datacenter plugin, which exposes the password through the API to an authenticated local attacker with view hosts permission. This poses a significant threat to data confidentiality and integrity, as well as system availability.

An issue with improper authorization handling was discovered, allowing authenticated local attackers to access and delete limited resources, and causing a denial of service on the server. The primary threats posed by this issue are to system integrity and availability.

An improper authorization handling flaw was found, allowing an authenticated local attacker to access and delete limited resources, and also causing a denial of service on the server. The highest threat from this issue is to integrity and system availability.

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 2.3.4 Foreman versions prior to 2.4.0 Description: The issue is related to improper authorization handling. An authenticated attacker can exploit this to impersonate the foreman-proxy if the product is configured to enable the Puppet Certificate Authority (CA) to sign certificate requests with subject alternative names (SANs). By default, Foreman does not enable SANs, and the `allow-authorization-extensions` setting is `false` unless the user explicitly changes the `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration. Recommendations: For Foreman versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue. For Foreman versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider disabling the Puppet Certificate Authority (CA) from signing certificate requests with subject alternative names (SANs) by ensuring `allow-authorization-extensions` is set to `false` in the `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration.

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 2.5.0 Description: A flaw in the smart proxy of Foreman, which provides a restful API to various sub-systems, can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, allowing an unauthenticated attacker to perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. Recommendations: For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the FreeIPA module of the Foreman smart proxy to minimize the risk of exploitation. Avoid using the smart proxy's restful API for sensitive operations until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite tfm-rubygem-foreman azure rm versions prior to 2.2.0 Description: A flaw in Red Hat Satellite's tfm-rubygem-foreman azure rm component can lead to a credential leak, exposing Azure Resource Manager's secret key through JSON in the API output. This issue primarily threatens data confidentiality and integrity, as well as system availability. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the API output to minimize the risk of credential exposure.

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite (affected versions not specified) Description: A flaw was found in Red Hat Satellite, where the BMC interface exposes the password through the API to an authenticated local attacker with view hosts permission. This poses a significant threat to data confidentiality and integrity, as well as system availability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A flaw was found in katello-debug where certain scripts and log files used insecure temporary files, allowing a local user to conduct a symbolic-link attack and overwrite the contents of arbitrary files.

The issue is related to input validation in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

The issue is related to multiple vulnerabilities in the Mutt package of the Debian GNU/Linux operating system, which can lead to disruption of protected information availability. These vulnerabilities can be exploited remotely. A buffer overflow in the copy.c file of Mutt before version 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.