CVE-2019-10136: Medium severity red hat satellite vulnerability

Q: What is CVE-2019-10136?

CVE-2019-10136 is a vulnerability found in Spacewalk, all versions through 2.9, which allows an attacker with a valid, but expired, authenticated set of headers to extend the session validity without modifying the checksum.

Q: How does CVE-2019-10136 affect Redhat Satellite?

CVE-2019-10136 affects Redhat Satellite 5.8.

Q: How does CVE-2019-10136 affect Redhat Spacewalk?

CVE-2019-10136 affects Redhat Spacewalk up to version 2.9.

Q: What is the severity of CVE-2019-10136?

CVE-2019-10136 has a severity rating of medium (4.3).

Q: How can I fix CVE-2019-10136?

To fix CVE-2019-10136, upgrade to a version of Spacewalk that is not affected by the vulnerability.

Published Jul 2, 2019

Updated

It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum.

Affected Software

2 affected components

redhat Satellite=5.8

redhat Spacewalk<=2.9

Event History

Jul 2, 2019

CVE Published

via MITRE·07:29 PM

Data Sourced

via MITRE·07:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2019-10136?

CVE-2019-10136 is a vulnerability found in Spacewalk, all versions through 2.9, which allows an attacker with a valid, but expired, authenticated set of headers to extend the session validity without modifying the checksum.

How does CVE-2019-10136 affect Redhat Satellite?

CVE-2019-10136 affects Redhat Satellite 5.8.

How does CVE-2019-10136 affect Redhat Spacewalk?

CVE-2019-10136 affects Redhat Spacewalk up to version 2.9.

What is the severity of CVE-2019-10136?

CVE-2019-10136 has a severity rating of medium (4.3).

How can I fix CVE-2019-10136?