CVE-2018-14643

Reference Links

• https://nvd.nist.gov/vuln/detail/CVE-2018-14643
• https://github.com/theforeman/smart_proxy_dynflow/pull/54
• https://access.redhat.com/errata/RHSA-2018:2733
• https://access.redhat.com/security/cve/CVE-2018-14643
• https://bugzilla.redhat.com/show_bug.cgi?id=1629063
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/smart_proxy_dynflow/CVE-2018-14643.yml
• https://github.com/advisories/GHSA-gx5g-xcxj-cx2w (Advisory)
• http://www.securityfocus.com/bid/105375
• https://github.com/theforeman/smart_proxy_dynflow/commit/cb7b0b5c9b602f737ab4c6e9fb47c158241cf49c#diff-6dee70f4339cfc3dd8cedfc2a34f14c2
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1629003
• https://www.cve.org/CVERecord?id=CVE-2018-14643 https://nvd.nist.gov/vuln/detail/CVE-2018-14643

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2018:2733

Frequently Asked Questions

• What is CVE-2018-14643?

  CVE-2018-14643 is an authentication bypass flaw in the smart_proxy_dynflow component used by Foreman, which allows remote execution of arbitrary commands on vulnerable Foreman instances.

• What is the severity of CVE-2018-14643?

  The severity of CVE-2018-14643 is critical with a CVSS score of 9.8.

• How does CVE-2018-14643 affect software?

  CVE-2018-14643 affects smart_proxy_dynflow versions up to exclusive 0.1.11 and 0.2.0 exactly, as well as Theforeman Foreman.

• How can CVE-2018-14643 be fixed?

  To fix CVE-2018-14643, upgrade smart_proxy_dynflow to version 0.1.11 or 0.2.1, or apply the relevant patch provided by the vendor.

• Where can I find more information about CVE-2018-14643?

  You can find more information about CVE-2018-14643 in the NVD, GitHub, and Red Hat Security Advisories.