REDHAT-BUG-1371328: Medium severity elog vulnerability
Published Aug 29, 2016
·Updated
It has been reported that one can post from any username entry on the logbook, with a post request and guest readable logbook, using elog 3.1.1.
Affected Software
1 affected component
ELOG ELOG
Event History
Aug 29, 2016
Data Sourced
via Red Hat·11:45 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-1371328?
The severity of REDHAT-BUG-1371328 is classified as a potential security risk due to unauthorized posting capabilities.
2
How do I fix REDHAT-BUG-1371328?
To address REDHAT-BUG-1371328, ensure that appropriate authentication measures are implemented for logbook entries.
3
What software is affected by REDHAT-BUG-1371328?
REDHAT-BUG-1371328 specifically affects elog version 3.1.1.
4
Can REDHAT-BUG-1371328 lead to information leaks?
Yes, REDHAT-BUG-1371328 can lead to information leaks due to guest-readable logbook permissions.
5
Is there a workaround for REDHAT-BUG-1371328?
As a temporary workaround for REDHAT-BUG-1371328, limit access to the logbook to authorized users only.