rhsa-2014_1037
Vulnerability from csaf_redhat
Published
2014-08-13 18:18
Modified
2024-11-22 08:11
Summary
Red Hat Security Advisory: cfme security and bug fix update

Notes

Topic
Updated cfme packages that fix one security issue and several bugs are now available for Red Hat CloudForms 3.0. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. It was found that the get and log methods of the AgentController wrote log messages without sanitizing user input. A remote attacker could use this flaw to insert arbitrary content into the log files written to by AgentController. (CVE-2014-0136) This issue was discovered by Jan Rusnacko of Red Hat Product Security. This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section. All users of Red Hat CloudForms 3.0 are advised to upgrade to these updated packages, which correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated cfme packages that fix one security issue and several bugs are now\navailable for Red Hat CloudForms 3.0.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat CloudForms Management Engine delivers the insight, control, and\nautomation needed to address the challenges of managing virtual\nenvironments. CloudForms Management Engine is built on Ruby on Rails, a\nmodel-view-controller (MVC) framework for web application development.\nAction Pack implements the controller and the view components.\n\nIt was found that the get and log methods of the AgentController wrote log\nmessages without sanitizing user input. A remote attacker could use this\nflaw to insert arbitrary content into the log files written to by\nAgentController. (CVE-2014-0136)\n\nThis issue was discovered by Jan Rusnacko of Red Hat Product Security.\n\nThis update also fixes several bugs. Documentation for these changes will\nbe available shortly from the Technical Notes document linked to in the\nReferences section.\n\nAll users of Red Hat CloudForms 3.0 are advised to upgrade to these updated\npackages, which correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1037",
        "url": "https://access.redhat.com/errata/RHSA-2014:1037"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-US/CloudForms/3.0/html/Management_Engine_5.2_Technical_Notes/index.html",
        "url": "https://access.redhat.com/documentation/en-US/CloudForms/3.0/html/Management_Engine_5.2_Technical_Notes/index.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-US/CloudForms/3.0/html/Management_Engine_5.2_Release_Notes/index.html",
        "url": "https://access.redhat.com/documentation/en-US/CloudForms/3.0/html/Management_Engine_5.2_Release_Notes/index.html"
      },
      {
        "category": "external",
        "summary": "1076669",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1076669"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1037.json"
      }
    ],
    "title": "Red Hat Security Advisory: cfme security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T08:11:33+00:00",
      "generator": {
        "date": "2024-11-22T08:11:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:1037",
      "initial_release_date": "2014-08-13T18:18:53+00:00",
      "revision_history": [
        {
          "date": "2014-08-13T18:18:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-08-13T18:18:53+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T08:11:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Management Engine",
                "product": {
                  "name": "Management Engine",
                  "product_id": "6Server-CFME",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cloudforms_managementengine:5::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat CloudForms"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cfme-0:5.2.5.3-2.el6cf.x86_64",
                "product": {
                  "name": "cfme-0:5.2.5.3-2.el6cf.x86_64",
                  "product_id": "cfme-0:5.2.5.3-2.el6cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.2.5.3-2.el6cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-lib-0:5.2.5.3-2.el6cf.x86_64",
                "product": {
                  "name": "cfme-lib-0:5.2.5.3-2.el6cf.x86_64",
                  "product_id": "cfme-lib-0:5.2.5.3-2.el6cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-lib@5.2.5.3-2.el6cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64",
                "product": {
                  "name": "mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64",
                  "product_id": "mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mingw32-cfme-host@5.2.5.3-2.el6cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.2.5.3-2.el6cf.x86_64",
                "product": {
                  "name": "cfme-appliance-0:5.2.5.3-2.el6cf.x86_64",
                  "product_id": "cfme-appliance-0:5.2.5.3-2.el6cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.2.5.3-2.el6cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64",
                "product": {
                  "name": "cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64",
                  "product_id": "cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-debuginfo@5.2.5.3-2.el6cf?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.2.5.3-2.el6cf.x86_64 as a component of Management Engine",
          "product_id": "6Server-CFME:cfme-0:5.2.5.3-2.el6cf.x86_64"
        },
        "product_reference": "cfme-0:5.2.5.3-2.el6cf.x86_64",
        "relates_to_product_reference": "6Server-CFME"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.2.5.3-2.el6cf.x86_64 as a component of Management Engine",
          "product_id": "6Server-CFME:cfme-appliance-0:5.2.5.3-2.el6cf.x86_64"
        },
        "product_reference": "cfme-appliance-0:5.2.5.3-2.el6cf.x86_64",
        "relates_to_product_reference": "6Server-CFME"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64 as a component of Management Engine",
          "product_id": "6Server-CFME:cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64"
        },
        "product_reference": "cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64",
        "relates_to_product_reference": "6Server-CFME"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-lib-0:5.2.5.3-2.el6cf.x86_64 as a component of Management Engine",
          "product_id": "6Server-CFME:cfme-lib-0:5.2.5.3-2.el6cf.x86_64"
        },
        "product_reference": "cfme-lib-0:5.2.5.3-2.el6cf.x86_64",
        "relates_to_product_reference": "6Server-CFME"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64 as a component of Management Engine",
          "product_id": "6Server-CFME:mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64"
        },
        "product_reference": "mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64",
        "relates_to_product_reference": "6Server-CFME"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jan Rusnacko"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0136",
      "cwe": {
        "id": "CWE-117",
        "name": "Improper Output Neutralization for Logs"
      },
      "discovery_date": "2014-03-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1076669"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the get and log methods of the AgentController wrote log messages without sanitizing user input. A remote attacker could use this flaw to insert arbitrary content into the log files written to by AgentController.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CFME: AgentController get/log application log forging",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CFME:cfme-0:5.2.5.3-2.el6cf.x86_64",
          "6Server-CFME:cfme-appliance-0:5.2.5.3-2.el6cf.x86_64",
          "6Server-CFME:cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64",
          "6Server-CFME:cfme-lib-0:5.2.5.3-2.el6cf.x86_64",
          "6Server-CFME:mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0136"
        },
        {
          "category": "external",
          "summary": "RHBZ#1076669",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1076669"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0136"
        }
      ],
      "release_date": "2014-08-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-08-13T18:18:53+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-CFME:cfme-0:5.2.5.3-2.el6cf.x86_64",
            "6Server-CFME:cfme-appliance-0:5.2.5.3-2.el6cf.x86_64",
            "6Server-CFME:cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64",
            "6Server-CFME:cfme-lib-0:5.2.5.3-2.el6cf.x86_64",
            "6Server-CFME:mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CFME:cfme-0:5.2.5.3-2.el6cf.x86_64",
            "6Server-CFME:cfme-appliance-0:5.2.5.3-2.el6cf.x86_64",
            "6Server-CFME:cfme-debuginfo-0:5.2.5.3-2.el6cf.x86_64",
            "6Server-CFME:cfme-lib-0:5.2.5.3-2.el6cf.x86_64",
            "6Server-CFME:mingw32-cfme-host-0:5.2.5.3-2.el6cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CFME: AgentController get/log application log forging"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.