It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade mgr-daemonUpgrade mgr-cfg-managementUpgrade python2-mgr-cfg-actionsUpgrade python2-mgr-cfgUpgrade python2-mgr-virtualization-commonUpgrade python2-mgr-osadUpgrade python2-mgr-osa-commonUpgrade spacewalk-remote-utilsUpgrade mgr-cfg-clientUpgrade python2-mgr-cfg-clientUpgrade mgr-cfgUpgrade python2-rhnlibUpgrade spacewalk-backend-libsUpgrade spacecmdUpgrade mgr-osadUpgrade python2-mgr-cfg-managementUpgrade python2-mgr-virtualization-hostUpgrade mgr-cfg-actionsUpgrade mgr-virtualization-host | Sep 6, 2019 | Jul 2, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub