A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.
CVSS Details
- CVSS 3.1 Base Score: 7.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hashieUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-localeUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-loggingUpgrade rubygem-clampUpgrade rubygem-http-cookieUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-highlineUpgrade rubygem-highlineUpgrade satellite-cliUpgrade rubygem-powerbarUpgrade satellite-brandingUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-netrcUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-apipie-bindingsUpgrade satelliteUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-typesUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-localeUpgrade tfm-runtimeUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-unfUpgrade rubygem-hammer_cliUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-mime-types-dataUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-clampUpgrade rubygem-oauthUpgrade rubygem-amazing_printUpgrade tfm-rubygem-rest-clientUpgrade rubygem-domain_nameUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-fast_gettextUpgrade satellite-cloneUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_azure_rm | Jul 14, 2022 | Dec 23, 2021 |
| Redhat_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-rest-clientUpgrade rubygem-jwtUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_katelloUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-loggingUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unf_extUpgrade rubygem-foreman_maintainUpgrade rubygem-localeUpgrade rubygem-powerbarUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cliUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-unicodeUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-cookieUpgrade rubygem-amazing_printUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hashieUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unfUpgrade foreman-cliUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foremanUpgrade satelliteUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-clampUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade tfm-runtimeUpgrade satellite-cliUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade satellite-brandingUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-highlineUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-domain_nameUpgrade rubygem-netrcUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsource | Jul 14, 2022 | Dec 23, 2021 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfo | Mar 12, 2024 | Dec 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub