CVE-2018-14643: Critical severity the foreman vulnerability
A vulnerability was discovered in the Foreman Remote Execution feature, allowing an unauthorized remote attacker to perform arbitrary code execution on managed hosts. The issue affects the component smartproxydynflow 0.1.8 and later (Foreman >= 1.15, Satellite >= 6.3)
Introducing commit:
https://github.com/theforeman/smartproxydynflow/commit/cb7b0b5c9b602f737ab4c6e9fb47c158241cf49c#diff-6dee70f4339cfc3dd8cedfc2a34f14c2
References:
https://bugzilla.redhat.com/showbug.cgi?id=1629003
Other sources
An authentication bypass flaw was found in the smartproxydynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2018-14643?
CVE-2018-14643 is an authentication bypass flaw in the smart_proxy_dynflow component used by Foreman, which allows remote execution of arbitrary commands on vulnerable Foreman instances.
What is the severity of CVE-2018-14643?
The severity of CVE-2018-14643 is critical with a CVSS score of 9.8.
How does CVE-2018-14643 affect software?
CVE-2018-14643 affects smart_proxy_dynflow versions up to exclusive 0.1.11 and 0.2.0 exactly, as well as Theforeman Foreman.
How can CVE-2018-14643 be fixed?
To fix CVE-2018-14643, upgrade smart_proxy_dynflow to version 0.1.11 or 0.2.1, or apply the relevant patch provided by the vendor.
Where can I find more information about CVE-2018-14643?
You can find more information about CVE-2018-14643 in the NVD, GitHub, and Red Hat Security Advisories.