An XML eXternal Entity (XXE) flaw was found in Nokogiri, a Ruby gem for parsing HTML, XML, and SAX. Using external XML entities, a remote attacker could specify a URL in a specially crafted XML that, when parsed, would cause a connection to that URL to be opened.

A patch shipped with the 1.5.4 release of Nokogiri provided a "nonet" option to disable external connections. However, local file URLs could still be used to exploit this flaw. The 1.6.4 release of Nokogiri fixed this issue by using libxml2 2.9.0.

Additional information is detailed at:

https://github.com/sparklemotion/nokogiri/issues/693#issuecomment-68334768

CVE request and assignment:

http://seclists.org/oss-sec/2015/q1/57

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.

Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.

Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.

Hui Wang and Keqin Hong of Red Hat report:

SAM web application is vulnerable to cross site scripting. An attacker can use XSS to send the malicious script that will be executed to an unsuspecting user.

katello-headpin is vulnerable to CSRF in REST API

Devan Goodwin <dgoodwin> reports:

We have identified a fairly serious security issue in previous, or upgraded versions of Subscription Asset Manager (SAM).

The issue was caused by an extremely insecure authentication mode in the candlepin project, which was mistakenly enabled by default if no setting was specified in the config file.