REDHAT-BUG-1340763: Low severity manageiq awesomespawn vulnerability

Published May 30, 2016

Updated

It was found that attacker having the access to appliance filesystem is able to execute arbitrary code under the same privileges as appliance runs. This issue is present since upstream commit f077196c99feb874e5cba8b93c1f8dfe26421c1b.

Upstream patch:

https://github.com/ManageIQ/manageiq/pull/7856

Affected Software

1 affected component

ManageIQ ManageIQ>=f077196c99feb874e5cba8b93c1f8dfe26421c1b

Event History

May 30, 2016

Data Sourced

via Red Hat·09:14 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1340763?

The severity of REDHAT-BUG-1340763 is high, as it allows an attacker with access to the appliance filesystem to execute arbitrary code.

How do I fix REDHAT-BUG-1340763?

To fix REDHAT-BUG-1340763, upgrade to the patched version of ManageIQ that addresses this vulnerability.

What versions of ManageIQ are affected by REDHAT-BUG-1340763?

ManageIQ versions from and including commit f077196c99feb874e5cba8b93c1f8dfe26421c1b are affected by REDHAT-BUG-1340763.

What can an attacker do with REDHAT-BUG-1340763?

An attacker exploiting REDHAT-BUG-1340763 can execute arbitrary code with the same privileges as the appliance.

Is there a upstream patch for REDHAT-BUG-1340763?

Yes, there is an upstream patch available to address the vulnerability described in REDHAT-BUG-1340763.