CVE-2018-10870: Input Validation

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2018-10870.

Q: What is the severity of CVE-2018-10870?

The severity of CVE-2018-10870 is critical with a severity value of 9.8.

Q: What software is affected by CVE-2018-10870?

The affected software is redhat-certification version 5.15.

Q: How can an attacker exploit the vulnerability?

An attacker could exploit this vulnerability by using it to overwrite any file, potentially gaining remote code execution.

Q: Where can I find more information about CVE-2018-10870?

You can find more information about CVE-2018-10870 on the following references: http://www.securityfocus.com/bid/104857, https://access.redhat.com/errata/RHSA-2018:2373, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10870

Published Jun 21, 2018

Updated

It has been discovered that redhat-certification does not properly sanitize paths in rhcertStore.py:saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.

Affected Software

3 affected componentsFixes available

redhat/redhat-certification 5.15<20180717

20180717

redhat certification

redhat Enterprise Linux=7.0

Event History

Jul 19, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2018-10870.

What is the severity of CVE-2018-10870?

The severity of CVE-2018-10870 is critical with a severity value of 9.8.

What software is affected by CVE-2018-10870?

The affected software is redhat-certification version 5.15.

How can an attacker exploit the vulnerability?

An attacker could exploit this vulnerability by using it to overwrite any file, potentially gaining remote code execution.

Where can I find more information about CVE-2018-10870?