vulnerability
CentOS Linux: CVE-2019-3845: Important: Red Hat Satellite Tools security update (CESA-2019:1223)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:A/AC:L/Au:S/C:P/I:P/A:P) | Apr 11, 2019 | Aug 28, 2019 | May 25, 2023 |
Severity
5
CVSS
(AV:A/AC:L/Au:S/C:P/I:P/A:P)
Published
Apr 11, 2019
Added
Aug 28, 2019
Modified
May 25, 2023
Description
A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.
Solution(s)
centos-upgrade-foreman-clicentos-upgrade-gofercentos-upgrade-katello-agentcentos-upgrade-katello-host-toolscentos-upgrade-katello-host-tools-fact-plugincentos-upgrade-katello-host-tools-tracercentos-upgrade-pulp-puppet-toolscentos-upgrade-pulp-rpm-handlerscentos-upgrade-puppet-agentcentos-upgrade-python-argcompletecentos-upgrade-python-gofercentos-upgrade-python-gofer-protoncentos-upgrade-python-hashlibcentos-upgrade-python-hashlib-debuginfocentos-upgrade-python-isodatecentos-upgrade-python-psutilcentos-upgrade-python-psutil-debuginfocentos-upgrade-python-psutil-debugsourcecentos-upgrade-python-pulp-agent-libcentos-upgrade-python-pulp-commoncentos-upgrade-python-pulp-manifestcentos-upgrade-python-pulp-puppet-commoncentos-upgrade-python-pulp-rpm-commoncentos-upgrade-python-qpid-protoncentos-upgrade-python-uuidcentos-upgrade-python2-beautifulsoup4centos-upgrade-python2-futurecentos-upgrade-python2-tracercentos-upgrade-python3-beautifulsoup4centos-upgrade-python3-futurecentos-upgrade-python3-gofercentos-upgrade-python3-gofer-protoncentos-upgrade-python3-psutilcentos-upgrade-python3-psutil-debuginfocentos-upgrade-python3-qpid-protoncentos-upgrade-python3-qpid-proton-debuginfocentos-upgrade-python3-tracercentos-upgrade-qpid-proton-ccentos-upgrade-qpid-proton-c-debuginfocentos-upgrade-qpid-proton-cpp-debuginfocentos-upgrade-qpid-proton-debuginfocentos-upgrade-qpid-proton-debugsourcecentos-upgrade-rubygem-foreman_scap_clientcentos-upgrade-rubygem-jsoncentos-upgrade-rubygem-json-debuginfocentos-upgrade-satellitecentos-upgrade-satellite-brandingcentos-upgrade-satellite-clicentos-upgrade-tfm-ror52-rubygem-mime-typescentos-upgrade-tfm-ror52-rubygem-mime-types-datacentos-upgrade-tfm-ror52-rubygem-multi_jsoncentos-upgrade-tfm-ror52-runtimecentos-upgrade-tfm-rubygem-apipie-bindingscentos-upgrade-tfm-rubygem-awesome_printcentos-upgrade-tfm-rubygem-clampcentos-upgrade-tfm-rubygem-domain_namecentos-upgrade-tfm-rubygem-fast_gettextcentos-upgrade-tfm-rubygem-hammer_clicentos-upgrade-tfm-rubygem-hammer_cli_csvcentos-upgrade-tfm-rubygem-hammer_cli_foremancentos-upgrade-tfm-rubygem-hammer_cli_foreman_admincentos-upgrade-tfm-rubygem-hammer_cli_foreman_ansiblecentos-upgrade-tfm-rubygem-hammer_cli_foreman_bootdiskcentos-upgrade-tfm-rubygem-hammer_cli_foreman_discoverycentos-upgrade-tfm-rubygem-hammer_cli_foreman_dockercentos-upgrade-tfm-rubygem-hammer_cli_foreman_openscapcentos-upgrade-tfm-rubygem-hammer_cli_foreman_remote_executioncentos-upgrade-tfm-rubygem-hammer_cli_foreman_taskscentos-upgrade-tfm-rubygem-hammer_cli_foreman_templatescentos-upgrade-tfm-rubygem-hammer_cli_foreman_virt_who_configurecentos-upgrade-tfm-rubygem-hammer_cli_katellocentos-upgrade-tfm-rubygem-hashiecentos-upgrade-tfm-rubygem-highlinecentos-upgrade-tfm-rubygem-http-cookiecentos-upgrade-tfm-rubygem-little-pluggercentos-upgrade-tfm-rubygem-localecentos-upgrade-tfm-rubygem-loggingcentos-upgrade-tfm-rubygem-netrccentos-upgrade-tfm-rubygem-oauthcentos-upgrade-tfm-rubygem-powerbarcentos-upgrade-tfm-rubygem-rest-clientcentos-upgrade-tfm-rubygem-unfcentos-upgrade-tfm-rubygem-unf_extcentos-upgrade-tfm-rubygem-unf_ext-debuginfocentos-upgrade-tfm-rubygem-unicodecentos-upgrade-tfm-rubygem-unicode-debuginfocentos-upgrade-tfm-rubygem-unicode-display_widthcentos-upgrade-tfm-runtimecentos-upgrade-tracer-common
References
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.