An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:0200-1 advisory.

  - An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection     issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could     be used by unauthenticated remote attackers to execute code as hauser. (CVE-2020-35458)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:0192-1 advisory.

  - An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection     issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could     be used by unauthenticated remote attackers to execute code as hauser. (CVE-2020-35458)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:0089-1 advisory.

  - An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection     issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could     be used by unauthenticated remote attackers to execute code as hauser. (CVE-2020-35458)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:0198-1 advisory.

  - An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection     issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could     be used by unauthenticated remote attackers to execute code as hauser. (CVE-2020-35458)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:0090-1 advisory.

  - An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection     issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could     be used by unauthenticated remote attackers to execute code as hauser. (CVE-2020-35458)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:0088-1 advisory.

  - An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection     issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could     be used by unauthenticated remote attackers to execute code as hauser. (CVE-2020-35458)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for hawk2 fixes the following security issue :

  - CVE-2020-35458: Fixed an insufficient input handler that     could have led to remote code execution (bsc#1179998).

This update was imported from the SUSE:SLE-15:Update update project.

This update for hawk2 fixes the following issues :

hawk2 was updated to version 2.4.0+git.1611141202.2fe6369e.

Security issue fixed :

  - Fixed another possible code execution vulnerability in     the controller code (bsc#1179998).

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
189635	SUSE SLES15 Security Update : hawk2 (SUSE-SU-2021:0200-1)	Nessus	SuSE Local Security Checks	critical
189634	SUSE SLES12 Security Update : hawk2 (SUSE-SU-2021:0192-1)	Nessus	SuSE Local Security Checks	critical
189632	SUSE SLES12 Security Update : hawk2 (SUSE-SU-2021:0089-1)	Nessus	SuSE Local Security Checks	critical
189631	SUSE SLES12 Security Update : hawk2 (SUSE-SU-2021:0198-1)	Nessus	SuSE Local Security Checks	critical
189630	SUSE SLES12 Security Update : hawk2 (SUSE-SU-2021:0090-1)	Nessus	SuSE Local Security Checks	critical
189629	SUSE SLES15 Security Update : hawk2 (SUSE-SU-2021:0088-1)	Nessus	SuSE Local Security Checks	critical
145390	openSUSE Security Update : hawk2 (openSUSE-2021-54)	Nessus	SuSE Local Security Checks	critical
145387	openSUSE Security Update : hawk2 (openSUSE-2021-74)	Nessus	SuSE Local Security Checks	critical
145339	openSUSE Security Update : hawk2 (openSUSE-2021-147)	Nessus	SuSE Local Security Checks	critical
145311	openSUSE Security Update : hawk2 (openSUSE-2021-144)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-35458

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical