A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.
CVSS Details
- CVSS 3.1 Base Score: 7.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-loggingUpgrade rubygem-netrcUpgrade rubygem-powerbarUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade tfm-rubygem-highlineUpgrade rubygem-clampUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade satellite-brandingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-typesUpgrade rubygem-unf_extUpgrade rubygem-localeUpgrade tfm-rubygem-hashieUpgrade rubygem-fast_gettextUpgrade satelliteUpgrade satellite-cliUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-highlineUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-loggingUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-little-pluggerUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-apipie-bindingsUpgrade tfm-runtimeUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-jwtUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-rest-clientUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-rest-clientUpgrade rubygem-oauthUpgrade rubygem-domain_nameUpgrade tfm-rubygem-clampUpgrade rubygem-amazing_printUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-domain_nameUpgrade satellite-cloneUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unfUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_ansible | Jul 14, 2022 | Dec 23, 2021 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-netrcUpgrade tfm-rubygem-domain_nameUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade satelliteUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-rest-clientUpgrade tfm-runtimeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-typesUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade tfm-rubygem-oauthUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-brandingUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unfUpgrade rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-rest-clientUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-clampUpgrade satellite-cloneUpgrade rubygem-jwtUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-oauthUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade rubygem-hammer_cliUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-cookieUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-foreman_maintainUpgrade rubygem-domain_nameUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-mime-typesUpgrade rubygem-unicodeUpgrade tfm-rubygem-loggingUpgrade rubygem-hashieUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-netrc | Jul 14, 2022 | Dec 23, 2021 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfo | Mar 12, 2024 | Dec 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub