RHSA-2015:1592: Important: Red Hat Satellite 6.1.1 on RHEL 6

Red Hat Product Security has rated this update as having an important<br>security impact. Common Vulnerability Scoring System (CVSS) base scores,<br>which give detailed severity ratings, are available for each vulnerability<br>from the CVE links in the References section.<br>Red Hat Satellite is a system management solution that allows organizations<br>to configure and maintain their systems without the necessity to provide <br>public Internet access to their servers or other client systems. It<br>performs provisioning and configuration management of predefined standard<br>operating environments.<br>This update provides Satellite 6.1 packages for Red Hat Enterprise Linux 6.<br>For the full list of new features provided by Satellite 6.1 see the Release<br>notes linked to in References section. (BZ#1201357)<br>It was discovered that, in Foreman, the editusers permission (for example,<br>granted to the Manager role) allowed the user to edit admin user passwords.<br>An attacker with the editusers permission could use this flaw to access <br>an admin user account, leading to an escalation of privileges.<br>(CVE-2015-3235)<br>It was found that Foreman did not set the HttpOnly flag on session cookies.<br>This could allow a malicious script to access the session cookie. <br>(CVE-2015-3155)<br>It was found that when making an SSL connection to an LDAP authentication <br>source in Foreman, the remote server certificate was accepted without any <br>verification against known certificate authorities, potentially making <br>TLS connections vulnerable to man-in-the-middle attacks. (CVE-2015-1816)<br>A flaw was found in the way Foreman authorized user actions on resources <br>via the API when an organization was not explicitly set. A remote attacker <br>could use this flaw to obtain additional information about resources they <br>were not authorized to access. (CVE-2015-1844)<br>A cross-site scripting (XSS) flaw was found in Foreman's template preview <br>screen. A remote attacker could use this flaw to perform cross-site <br>scripting attacks by tricking a user into viewing a malicious template. <br>Note that templates are commonly shared among users. (CVE-2014-3653)<br>It was found that python-oauth2 did not properly verify the nonce of a <br>signed URL. An attacker able to capture network traffic of a website using <br>OAuth2 authentication could use this flaw to conduct replay attacks <br>against that website. (CVE-2013-4346)<br>It was found that python-oauth2 did not properly generate random values <br>for use in nonces. An attacker able to capture network traffic of a website<br>using OAuth2 authentication could use this flaw to conduct replay attacks <br>against that website. (CVE-2013-4347)<br>Red Hat would like to thank Rufus Järnefelt of Coresec for reporting the <br>Foreman HttpOnly issue.<br>All users who require Satellite 6.1 are advised to install these new<br>packages.