An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5980 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security fix(es):

    * golang: net/http, x/net/http2: rapid stream resets can cause excessive work (Rapid Reset)     (CVE-2023-39325)

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset)     (CVE-2023-44487)

    A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaws is available in     the References section.

    * ruby-git: code injection vulnerability (CVE-2022-46648)

    * ruby-git: code injection vulnerability (CVE-2022-47318)

    * Foreman: Arbitrary code execution through templates (CVE-2023-0118)

    * Satellite/Foreman: Arbitrary code execution through yaml global parameters (CVE-2023-0462)

    * openssl: c_rehash script allows command injection (CVE-2022-1292)

    * openssl: the c_rehash script allows command injection (CVE-2022-2068)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    This update fixes the following bugs:

    2159417 - CVE-2023-0118 foreman: Arbitrary code execution through templates [rhn_satellite_6.11]     2163523 - CVE-2023-0462 foreman: Satellite/Foreman: Arbitrary code execution through yaml global     parameters [rhn_satellite_6.11]     2242355 - CVE-2022-1292 CVE-2022-2068 puppet-agent for Satellite and Capsule: various flaws     [rhn_satellite_6.11]     2242360 - CVE-2022-47318 tfm-rubygem-git: ruby-git: code injection vulnerability [rhn_satellite_6.11]     2242364 - CVE-2022-46648 rubygem-git: ruby-git: code injection vulnerability [rhn_satellite_6.11]     2243832 - [Major Incident] CVE-2023-39325 CVE-2023-44487 yggdrasil-worker-forwarder: various flaws     [rhn_satellite_6.11]

    Users of Red Hat Satellite are advised to upgrade to these updated packages,     which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5931 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security fix(es):

    * Yggdrasil-worker-forwarder (gRPC): Rapid Reset Attack through HTTP/2 enabled web service which leads to     DDoS attack (CVE-2023-44487 & CVE-2023-39325)

    A Red Hat Security Bulletin which addresses further details about this flaw is available in the References     section.

    * Foreman: OS command injection via ct_command and fcct_command (CVE-2022-3874)

    * Foreman: Arbitrary code execution through yaml global parameters (CVE-2023-0462)

    * GitPython: Remote code execution and improper input validation vulnerability (CVE-2022-24439 &     CVE-2023-40267)

    * Ruby-git & tfm-rubygem-git: Code injection vulnerability (CVE-2022-47318 & CVE-2022-46648)

    * Python-django: Multiple flaws (CVE-2023-31047 & CVE-2023-36053)

    * Puppet-agent (openssl): Multiple flaws (CVE-2022-1292 CVE-2022-2068)

    This update fixes the following bugs:

    2238346 - Red Hat supported provisioning templates are not recognized by RH icon on the row for a given     template     2238348 - when creating a backup on rhel7 and restoring on rhel8, the restore process will fail with     permission issues     2238350 - Virtual machine goes in re-provisioning mode while registration host using Global registration     template.
    2238359 - Capsule redundantly synces *-Export-Library repos     2238361 - Can't update the redhat_repository_url without changing the cdn_configuration to custom_cdn     2238363 - katello-certs-check does not cause the installer to halt execution on failure     2238367 - Satellite Web UI >> Hosts >> All Hosts page loading slow even after power isn't selected from     the new option Manage columns.
    2238369 - Content-export incremental with syncable format based does not include productid file into     repodata directory     2238371 - SELinux is preventing pulpcore-worker from read access on the key labeled pulpcore_server_t     2239041 - Reclaim space for repository fails with Cannot delete some instances of model 'Artifact' because     they are referenced through protected foreign keys: 'ContentArtifact.artifact'.
    2238353 - The hammer export command using single thread encryption causes a performance bottleneck.
    2240781 - Remediation from CRC via Satellite shows Failed status even after successful remediation of     Insights recommendations.
    2241914 - NoMethodError: undefined method `fact_values' while trying to perform inventory upload

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5979 advisory.

    Red Hat Satellite is a system management solution that allows organizations to     configure and maintain their systems without the necessity to provide public     Internet access to their servers or other client systems. It performs     provisioning and configuration management of predefined standard operating     environments.

    Security fix(es):

    foreman: Arbitrary code execution through templates

    foreman: Satellite/Foreman: Arbitrary code execution through yaml global parameters

    foreman: OS command injection via ct_command and fcct_command

    puppet-agent for Satellite and Capsule: various flaws

    tfm-rubygem-git: ruby-git: code injection vulnerability

    rubygem-git: ruby-git: code injection vulnerability

    yggdrasil-worker-forwarder: various flaws

    This update fixes the following bugs:

    2159656 - CVE-2023-0118 foreman: Arbitrary code execution through templates [rhn_satellite_6.12]     2163524 - CVE-2023-0462 foreman: Satellite/Foreman: Arbitrary code execution through yaml global     parameters [rhn_satellite_6.12]     2163694 - CVE-2022-3874 foreman: OS command injection via ct_command and fcct_command [rhn_satellite_6.12]     2242354 - CVE-2022-1292 CVE-2022-2068 puppet-agent for Satellite and Capsule: various flaws     [rhn_satellite_6.12]     2242359 - CVE-2022-47318 tfm-rubygem-git: ruby-git: code injection vulnerability [rhn_satellite_6.12]     2242362 - CVE-2022-46648 rubygem-git: ruby-git: code injection vulnerability [rhn_satellite_6.12]     2243833 - [Major Incident] CVE-2023-39325 CVE-2023-44487 yggdrasil-worker-forwarder: various flaws     [rhn_satellite_6.12]

    Users of Red Hat Satellite are advised to upgrade to these updated packages,     which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194416	RHEL 7 / 8 : Satellite 6.11.5.6 async (RHSA-2023:5980)	Nessus	Red Hat Local Security Checks	critical
194378	RHEL 8 : Satellite 6.13.5 Async Security Update (Important) (RHSA-2023:5931)	Nessus	Red Hat Local Security Checks	critical
194359	RHEL 8 : Satellite 6.12.5.2 Async Security Update (Important) (RHSA-2023:5979)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2023-0462

critical

Tenable Plugins

critical

critical

critical