CVE-2024-7923: Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
An authentication bypass vulnerability has been identified in Foreman when deployed with Gunicorn versions prior to 22.0, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 4.0+ and could potentially enable unauthorized users to gain administrative access.
Other sources
An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7923?
CVE-2024-7923 is considered a critical severity vulnerability due to its potential for authentication bypass.
How do I fix CVE-2024-7923?
To fix CVE-2024-7923, upgrade Gunicorn to version 22.0 or later and ensure proper configuration of your Foreman deployment.
Which versions of Red Hat Satellite are affected by CVE-2024-7923?
CVE-2024-7923 affects Red Hat Satellite versions 6.13, 6.14, and 6.15.
What type of vulnerability is CVE-2024-7923?
CVE-2024-7923 is classified as an authentication bypass vulnerability.
How does CVE-2024-7923 impact users?
CVE-2024-7923 can potentially allow unauthorized access to sensitive resources by bypassing authentication mechanisms.