CVE-2016-4995: Infoleak
First published: Wed Jun 22 2016(Updated: )
Dominic Cleal of Red Hat reports: Users who are logged in with permissions to view some hosts are able to preview provisioning templates for any host by specifying its hostname in the URL, as the specific view_hosts permissions and filters aren't checked. If the organization or location features are enabled, the user will still be restricted to their associated orgs/locs. This can disclose configuration information about the host, including root password hashes if used in preseed/kickstart templates. Upstream bug: <a href="http://projects.theforeman.org/issues/15490">http://projects.theforeman.org/issues/15490</a> Proposed patch: <a href="https://github.com/theforeman/foreman/pull/2428">https://github.com/theforeman/foreman/pull/2428</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Foreman | >=1.11.0<1.11.4 | |
| Foreman | >=1.12.0<1.12.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://projects.theforeman.org/issues/15490
- https://github.com/theforeman/foreman/pull/2428
- https://access.redhat.com/errata/RHSA-2018:0336
- https://bugzilla.redhat.com/show_bug.cgi?id=1348939
- http://projects.theforeman.org/projects/foreman/repository/revisions/c3c186de12be15e55d9582e54659f765304a1073
- https://theforeman.org/security.html#2016-4995
Frequently Asked Questions
What is the severity of CVE-2016-4995?
CVE-2016-4995 has a medium severity level due to unauthorized access to provisioning templates.
How do I fix CVE-2016-4995?
To fix CVE-2016-4995, upgrade to Foreman versions higher than 1.11.4 or 1.12.1 as appropriate.
Who is affected by CVE-2016-4995?
Users of Foreman versions 1.11.0 to 1.11.4 and 1.12.0 to 1.12.1 are affected by CVE-2016-4995.
What type of vulnerability is CVE-2016-4995?
CVE-2016-4995 is a security vulnerability caused by insufficient permission checks for provisioning templates.
Can logged-in users exploit CVE-2016-4995?
Yes, logged-in users with view permissions can exploit CVE-2016-4995 to access provisioning templates for any host.
- agent/references
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-4995
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/theforeman
- canonical/foreman
- version/foreman/1.11.0
- version/foreman/1.12.0