RHSA-2020_3358
Vulnerability from csaf_redhat - Published: 2020-08-06 14:34 - Updated: 2024-11-22 15:23Summary
Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update
Severity
Critical
Notes
Topic: An update is now available for CloudForms Management Engine 5.11.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* cfme: CloudForms: CSV Injection in Orchestration Templates (CVE-2020-10780)
* cfme: CloudForms: Server-Side Request Forgery (SSRF) in Ansible Tower Provider (CVE-2020-14296)
* cfme: CloudForms: Out-of-band OS Command Injection through conversion host (CVE-2020-14324)
* cfme: CloudForms: User Impersonation in the API for OIDC and SAML (CVE-2020-14325)
* cfme-gemset: CloudForms: Cross Site Scripting in report menu title / HTML Code Injection (CVE-2020-10777)
* cfme-gemset: CloudForms: Business logic bypass through widgets (CVE-2020-10778)
* cfme-gemset: CloudForms: Missing functional level access control & IDOR lead to compromise (CVE-2020-10779)
* cfme-gemset: CloudForms: Missing access control leads to escalation of admin group privileges (CVE-2020-10783)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Purnachand Pulahari (IBM) and Ranjit Kumar Singh (IBM) for reporting CVE-2020-10777, CVE-2020-10778, CVE-2020-10779, CVE-2020-10780, CVE-2020-10783, CVE-2020-14296 and CVE-2020-14324. CVE-2020-14325 was discovered by Alberto Bellotti (Red Hat).
Additional Changes:
This update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Report Menu of Red Hat CloudForms where the title field was not properly sanitized for HTML and JavaScript inputs. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that Content Security Policy can prevent exploitation of this XSS however not all browsers support CSP.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:3358
A business logic flaw was found in Red Hat CloudForms where the read-only values of the Widgets could be altered. An attacker with low privileges could bypass server-side validation by dropping the disabled attribute from the fields.
8.2 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:3358
A flaw was found in Red Hat CloudForms where sensitive data would have been possibly leaked for other existing roles. An attacker with low privilege could make use of EVM-Admin API if certain criteria is met since there was no privilege check on feature.
7.6 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:3358
Workaround
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
A flaw was found in Orchestration Template of Red Hat CloudForms where a low privilege user could enter crafted CSV formulae. Successful exploitation will allow an attacker to execute arbitrary code with the privilege of currently logged in user of the system causing serious damage to the victim’s system.
6.3 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:3358
A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator. Refer CVE-2020-25716 for remaining RBAC group fixes.
8.4 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:3358
Workaround
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
A Server-Side Request Forgery flaw was found in Red Hat CloudForms where malicious requests can be sent from the vulnerable server. An attacker with the privileges to add Ansible Tower provider could inject URLs with port details or with internal IPs to observe internal network.
6.8 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:3358
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
An out-of-band OS command injection vulnerability was found in Red Hat CloudForms. An authenticated malicious attacker could execute arbitrary commands on the server by sending a specially crafted request. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
9.1 (Critical)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:3358
Workaround
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
A vulnerability was found in Red Hat CloudForms which allows a malicious attacker to impersonate any user or create a non-existent user with any entitlement in the appliance and perform an API request.
9.9 (Critical)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2020:3358
Workaround
Red Hat recommends upgrading to secured released versions, however, this flaw can be mitigated by unseting RequestHeader in http configuration. Mitigation steps would be:
1. Stop httpd service
$ systemctl stop httpd
2. Add following additional unset at `/etc/httpd/conf.d/manageiq-remote-user-openidc.conf` and `/etc/httpd/conf.d/manageiq-remote-user.conf`, right before `X_REMOTE_USER` unset.
~~~
RequestHeader unset X-REMOTE-USER
RequestHeader unset X-REMOTE_USER
RequestHeader unset X_REMOTE-USER
~~~
3. Validate configuration files to make sure all syntax is valid
$ apachectl configtest
4. Restart httpd service
$ systemctl start httpd
References
Acknowledgments
IBM
Purnachand Pulahari
Ranjit Kumar Singh
IBM
Sruthi M
Pravat Kumar Sahoo
Red Hat
Alberto Bellotti
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for CloudForms Management Engine 5.11.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* cfme: CloudForms: CSV Injection in Orchestration Templates (CVE-2020-10780)\n\n* cfme: CloudForms: Server-Side Request Forgery (SSRF) in Ansible Tower Provider (CVE-2020-14296)\n\n* cfme: CloudForms: Out-of-band OS Command Injection through conversion host (CVE-2020-14324)\n\n* cfme: CloudForms: User Impersonation in the API for OIDC and SAML (CVE-2020-14325)\n\n* cfme-gemset: CloudForms: Cross Site Scripting in report menu title / HTML Code Injection (CVE-2020-10777)\n\n* cfme-gemset: CloudForms: Business logic bypass through widgets (CVE-2020-10778)\n\n* cfme-gemset: CloudForms: Missing functional level access control \u0026 IDOR lead to compromise (CVE-2020-10779)\n\n* cfme-gemset: CloudForms: Missing access control leads to escalation of admin group privileges (CVE-2020-10783)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Purnachand Pulahari (IBM) and Ranjit Kumar Singh (IBM) for reporting CVE-2020-10777, CVE-2020-10778, CVE-2020-10779, CVE-2020-10780, CVE-2020-10783, CVE-2020-14296 and CVE-2020-14324. CVE-2020-14325 was discovered by Alberto Bellotti (Red Hat).\n\nAdditional Changes:\n\nThis update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:3358",
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/5.0/html/release_notes",
"url": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/5.0/html/release_notes"
},
{
"category": "external",
"summary": "1671330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671330"
},
{
"category": "external",
"summary": "1713212",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713212"
},
{
"category": "external",
"summary": "1734629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1734629"
},
{
"category": "external",
"summary": "1734630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1734630"
},
{
"category": "external",
"summary": "1741310",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741310"
},
{
"category": "external",
"summary": "1753586",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753586"
},
{
"category": "external",
"summary": "1757128",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757128"
},
{
"category": "external",
"summary": "1770197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1770197"
},
{
"category": "external",
"summary": "1809033",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1809033"
},
{
"category": "external",
"summary": "1810040",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1810040"
},
{
"category": "external",
"summary": "1810477",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1810477"
},
{
"category": "external",
"summary": "1826410",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826410"
},
{
"category": "external",
"summary": "1832278",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1832278"
},
{
"category": "external",
"summary": "1834219",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1834219"
},
{
"category": "external",
"summary": "1836125",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1836125"
},
{
"category": "external",
"summary": "1836158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1836158"
},
{
"category": "external",
"summary": "1837993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1837993"
},
{
"category": "external",
"summary": "1838704",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1838704"
},
{
"category": "external",
"summary": "1839770",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1839770"
},
{
"category": "external",
"summary": "1845281",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845281"
},
{
"category": "external",
"summary": "1846281",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1846281"
},
{
"category": "external",
"summary": "1847410",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847410"
},
{
"category": "external",
"summary": "1847605",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847605"
},
{
"category": "external",
"summary": "1847628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847628"
},
{
"category": "external",
"summary": "1847647",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847647"
},
{
"category": "external",
"summary": "1847794",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847794"
},
{
"category": "external",
"summary": "1847811",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847811"
},
{
"category": "external",
"summary": "1847860",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847860"
},
{
"category": "external",
"summary": "1847884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847884"
},
{
"category": "external",
"summary": "1847898",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847898"
},
{
"category": "external",
"summary": "1848265",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1848265"
},
{
"category": "external",
"summary": "1850952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850952"
},
{
"category": "external",
"summary": "1855713",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855713"
},
{
"category": "external",
"summary": "1855739",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855739"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3358.json"
}
],
"title": "Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update",
"tracking": {
"current_release_date": "2024-11-22T15:23:57+00:00",
"generator": {
"date": "2024-11-22T15:23:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2020:3358",
"initial_release_date": "2020-08-06T14:34:12+00:00",
"revision_history": [
{
"date": "2020-08-06T14:34:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-08-06T14:34:12+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:23:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "CloudForms Management Engine 5.11",
"product": {
"name": "CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:cloudforms_managementengine:5.11::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat CloudForms"
},
{
"branches": [
{
"category": "product_version",
"name": "v2v-conversion-host-0:1.16.2-3.el8ev.src",
"product": {
"name": "v2v-conversion-host-0:1.16.2-3.el8ev.src",
"product_id": "v2v-conversion-host-0:1.16.2-3.el8ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v2v-conversion-host@1.16.2-3.el8ev?arch=src"
}
}
},
{
"category": "product_version",
"name": "cfme-0:5.11.7.3-1.el8cf.src",
"product": {
"name": "cfme-0:5.11.7.3-1.el8cf.src",
"product_id": "cfme-0:5.11.7.3-1.el8cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme@5.11.7.3-1.el8cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "cfme-appliance-0:5.11.7.3-1.el8cf.src",
"product": {
"name": "cfme-appliance-0:5.11.7.3-1.el8cf.src",
"product_id": "cfme-appliance-0:5.11.7.3-1.el8cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme-appliance@5.11.7.3-1.el8cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "cfme-gemset-0:5.11.7.3-1.el8cf.src",
"product": {
"name": "cfme-gemset-0:5.11.7.3-1.el8cf.src",
"product_id": "cfme-gemset-0:5.11.7.3-1.el8cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme-gemset@5.11.7.3-1.el8cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"product": {
"name": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"product_id": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.11.7.3-1.el8cf?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch",
"product": {
"name": "v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch",
"product_id": "v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v2v-conversion-host-ansible@1.16.2-3.el8ev?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cfme-0:5.11.7.3-1.el8cf.x86_64",
"product": {
"name": "cfme-0:5.11.7.3-1.el8cf.x86_64",
"product_id": "cfme-0:5.11.7.3-1.el8cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme@5.11.7.3-1.el8cf?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"product": {
"name": "cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"product_id": "cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme-appliance@5.11.7.3-1.el8cf?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"product": {
"name": "cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"product_id": "cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme-appliance-common@5.11.7.3-1.el8cf?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"product": {
"name": "cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"product_id": "cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme-appliance-tools@5.11.7.3-1.el8cf?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"product": {
"name": "cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"product_id": "cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme-gemset@5.11.7.3-1.el8cf?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"product": {
"name": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"product_id": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.11.7.3-1.el8cf?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-0:5.11.7.3-1.el8cf.src as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src"
},
"product_reference": "cfme-0:5.11.7.3-1.el8cf.src",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-0:5.11.7.3-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
},
"product_reference": "cfme-0:5.11.7.3-1.el8cf.x86_64",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src"
},
"product_reference": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64"
},
"product_reference": "cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-appliance-0:5.11.7.3-1.el8cf.src as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src"
},
"product_reference": "cfme-appliance-0:5.11.7.3-1.el8cf.src",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-appliance-0:5.11.7.3-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64"
},
"product_reference": "cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64"
},
"product_reference": "cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64"
},
"product_reference": "cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-gemset-0:5.11.7.3-1.el8cf.src as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src"
},
"product_reference": "cfme-gemset-0:5.11.7.3-1.el8cf.src",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cfme-gemset-0:5.11.7.3-1.el8cf.x86_64 as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
},
"product_reference": "cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v2v-conversion-host-0:1.16.2-3.el8ev.src as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src"
},
"product_reference": "v2v-conversion-host-0:1.16.2-3.el8ev.src",
"relates_to_product_reference": "8Base-CFME-5.11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch as a component of CloudForms Management Engine 5.11",
"product_id": "8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
},
"product_reference": "v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch",
"relates_to_product_reference": "8Base-CFME-5.11"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Purnachand Pulahari",
"Ranjit Kumar Singh"
],
"organization": "IBM"
}
],
"cve": "CVE-2020-10777",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2020-06-16T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1847605"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Report Menu of Red Hat CloudForms where the title field was not properly sanitized for HTML and JavaScript inputs. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that Content Security Policy can prevent exploitation of this XSS however not all browsers support CSP.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CloudForms: Cross Site Scripting in report menu title / HTML Code Injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
],
"known_not_affected": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10777"
},
{
"category": "external",
"summary": "RHBZ#1847605",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847605"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10777",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10777"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10777",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10777"
}
],
"release_date": "2020-08-03T13:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-06T14:34:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CloudForms: Cross Site Scripting in report menu title / HTML Code Injection"
},
{
"acknowledgments": [
{
"names": [
"Purnachand Pulahari",
"Ranjit Kumar Singh"
],
"organization": "IBM"
}
],
"cve": "CVE-2020-10778",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"discovery_date": "2020-06-16T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1847628"
}
],
"notes": [
{
"category": "description",
"text": "A business logic flaw was found in Red Hat CloudForms where the read-only values of the Widgets could be altered. An attacker with low privileges could bypass server-side validation by dropping the disabled attribute from the fields.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CloudForms: Business logic bypass through widgets",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
],
"known_not_affected": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10778"
},
{
"category": "external",
"summary": "RHBZ#1847628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10778",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10778"
}
],
"release_date": "2020-08-03T13:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-06T14:34:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CloudForms: Business logic bypass through widgets"
},
{
"acknowledgments": [
{
"names": [
"Purnachand Pulahari",
"Ranjit Kumar Singh"
],
"organization": "IBM"
}
],
"cve": "CVE-2020-10779",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2020-06-16T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1847647"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat CloudForms where sensitive data would have been possibly leaked for other existing roles. An attacker with low privilege could make use of EVM-Admin API if certain criteria is met since there was no privilege check on feature.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CloudForms: Missing functional level access control \u0026 IDOR lead to compromise",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
],
"known_not_affected": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10779"
},
{
"category": "external",
"summary": "RHBZ#1847647",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847647"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10779",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10779"
}
],
"release_date": "2020-08-03T13:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-06T14:34:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CloudForms: Missing functional level access control \u0026 IDOR lead to compromise"
},
{
"acknowledgments": [
{
"names": [
"Purnachand Pulahari",
"Ranjit Kumar Singh"
],
"organization": "IBM"
}
],
"cve": "CVE-2020-10780",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1847794"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Orchestration Template of Red Hat CloudForms where a low privilege user could enter crafted CSV formulae. Successful exploitation will allow an attacker to execute arbitrary code with the privilege of currently logged in user of the system causing serious damage to the victim\u2019s system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CloudForms: CSV Injection in Orchestration Templates",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
],
"known_not_affected": [
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10780"
},
{
"category": "external",
"summary": "RHBZ#1847794",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847794"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10780",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10780"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10780",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10780"
}
],
"release_date": "2020-08-03T13:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-06T14:34:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CloudForms: CSV Injection in Orchestration Templates"
},
{
"acknowledgments": [
{
"names": [
"Purnachand Pulahari",
"Ranjit Kumar Singh"
],
"organization": "IBM"
}
],
"cve": "CVE-2020-10783",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1847811"
}
],
"notes": [
{
"category": "description",
"text": "A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator.\r\n\r\nRefer CVE-2020-25716 for remaining RBAC group fixes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CloudForms: Missing access control leads to escalation of admin group privileges",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
],
"known_not_affected": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10783"
},
{
"category": "external",
"summary": "RHBZ#1847811",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847811"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10783",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10783"
}
],
"release_date": "2020-08-03T13:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-06T14:34:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CloudForms: Missing access control leads to escalation of admin group privileges"
},
{
"acknowledgments": [
{
"names": [
"Purnachand Pulahari",
"Ranjit Kumar Singh"
],
"organization": "IBM"
}
],
"cve": "CVE-2020-14296",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1847860"
}
],
"notes": [
{
"category": "description",
"text": "A Server-Side Request Forgery flaw was found in Red Hat CloudForms where malicious requests can be sent from the vulnerable server. An attacker with the privileges to add Ansible Tower provider could inject URLs with port details or with internal IPs to observe internal network.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CloudForms: Server-Side Request Forgery (SSRF) in Ansible Tower Provider",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
],
"known_not_affected": [
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14296"
},
{
"category": "external",
"summary": "RHBZ#1847860",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847860"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14296",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14296"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14296",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14296"
}
],
"release_date": "2020-08-03T13:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-06T14:34:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CloudForms: Server-Side Request Forgery (SSRF) in Ansible Tower Provider"
},
{
"acknowledgments": [
{
"names": [
"Sruthi M",
"Pravat Kumar Sahoo"
],
"organization": "IBM"
}
],
"cve": "CVE-2020-14324",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2020-07-10T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1855713"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-band OS command injection vulnerability was found in Red Hat CloudForms. An authenticated malicious attacker could execute arbitrary commands on the server by sending a specially crafted request. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CloudForms: Out-of-band OS Command Injection through conversion host",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
],
"known_not_affected": [
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14324"
},
{
"category": "external",
"summary": "RHBZ#1855713",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855713"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14324",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14324"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14324",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14324"
}
],
"release_date": "2020-08-03T13:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-06T14:34:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CloudForms: Out-of-band OS Command Injection through conversion host"
},
{
"acknowledgments": [
{
"names": [
"Alberto Bellotti"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2020-14325",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2020-07-10T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1855739"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Red Hat CloudForms which allows a malicious attacker to impersonate any user or create a non-existent user with any entitlement in the appliance and perform an API request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CloudForms: User Impersonation in the API for OIDC and SAML",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability and related criticality depends on the product releases and protocols. \nIn CloudForms 5.11, attacker need to be authenticated through OIDC but SAML do not need any authentication for exploitation. However, for CloudForms 5.10, both SAML and OIDC protocols does not need authentication and attacker can impersonate users previously logged in.\n\nRed Hat does not support CloudForms 5.9 and earlier releases, however, confirms vulnerability affects SAML protocol but not OIDC.\nReference metrics: https://bugzilla.redhat.com/show_bug.cgi?id=1855739#c3",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
],
"known_not_affected": [
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14325"
},
{
"category": "external",
"summary": "RHBZ#1855739",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855739"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14325",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14325"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14325",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14325"
},
{
"category": "external",
"summary": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-84f5-5g5v-g8vr",
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-84f5-5g5v-g8vr"
}
],
"release_date": "2020-08-03T13:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-06T14:34:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3358"
},
{
"category": "workaround",
"details": "Red Hat recommends upgrading to secured released versions, however, this flaw can be mitigated by unseting RequestHeader in http configuration. Mitigation steps would be:\n\n1. Stop httpd service\n$ systemctl stop httpd\n\n2. Add following additional unset at `/etc/httpd/conf.d/manageiq-remote-user-openidc.conf` and `/etc/httpd/conf.d/manageiq-remote-user.conf`, right before `X_REMOTE_USER` unset. \n~~~\nRequestHeader unset X-REMOTE-USER\nRequestHeader unset X-REMOTE_USER\nRequestHeader unset X_REMOTE-USER\n~~~\n\n3. Validate configuration files to make sure all syntax is valid\n$ apachectl configtest\n\n4. Restart httpd service\n$ systemctl start httpd",
"product_ids": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-amazon-smartstate-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-appliance-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-common-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-appliance-tools-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-gemset-0:5.11.7.3-1.el8cf.x86_64",
"8Base-CFME-5.11:v2v-conversion-host-0:1.16.2-3.el8ev.src",
"8Base-CFME-5.11:v2v-conversion-host-ansible-0:1.16.2-3.el8ev.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.src",
"8Base-CFME-5.11:cfme-0:5.11.7.3-1.el8cf.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "CloudForms: User Impersonation in the API for OIDC and SAML"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…