CVE-2022-3874: Os command injection via ct_command and fcct_command
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
Other sources
In the Foreman component of Satellite, the ctcommand and fcctcommand settings allow authenticated users to execute arbitrary commands on the server. These commands are used to transpile CoreOS and Fedora CoreOS configurations in templates. Changing the command requires admin privileges on the Foreman instance.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-3874?
CVE-2022-3874 is a command injection vulnerability found in the foreman application.
What is the severity of CVE-2022-3874?
CVE-2022-3874 has a severity rating of 9.1 (critical).
How does CVE-2022-3874 affect Redhat Satellite?
CVE-2022-3874 affects Redhat Satellite 6.0.
How does CVE-2022-3874 affect Theforeman Foreman?
CVE-2022-3874 affects Theforeman Foreman.
How can I fix CVE-2022-3874?
To fix CVE-2022-3874, it is recommended to update to the latest version of the foreman application.