A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.
CVSS Details
- CVSS 3.1 Base Score: 7.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-jwtUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-rest-clientUpgrade satellite-cloneUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-clampUpgrade rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-unfUpgrade rubygem-rest-clientUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicodeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cliUpgrade rubygem-amazing_printUpgrade tfm-rubygem-netrcUpgrade foreman-cliUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-powerbarUpgrade tfm-runtimeUpgrade tfm-rubygem-localeUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satelliteUpgrade rubygem-mime-typesUpgrade rubygem-fast_gettextUpgrade rubygem-clampUpgrade rubygem-loggingUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-amazing_printUpgrade satellite-maintainUpgrade rubygem-netrcUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cliUpgrade satellite-cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade satellite-brandingUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-little-plugger | Jul 14, 2022 | Dec 23, 2021 |
| Redhat_linux | — | Upgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-highlineUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade satelliteUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-http-cookieUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-jwtUpgrade satellite-cliUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade satellite-brandingUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-jwtUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unfUpgrade rubygem-unf_extUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-clampUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-localeUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-domain_nameUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-loggingUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-types-dataUpgrade rubygem-http-cookieUpgrade rubygem-fast_gettextUpgrade rubygem-unicodeUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-netrcUpgrade satellite-cloneUpgrade rubygem-rest-clientUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_webhooks | Jul 14, 2022 | Dec 23, 2021 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfo | Mar 12, 2024 | Dec 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub