Hi, From [2]: #### CVE-2024-7923: Authentication bypass in Pulpcore An authentication bypass vulnerability has been identified in Pulpcore when deployed by the Foreman Installer with Gunicorn versions prior to 22.0. This issue arises from the way Apache is configured to do certificate authentication and pass this information to the Gunicorn backend, without unsetting all headers coming from a possibly malicious client. Affects Katello 4.0.0 and higher Fix released in Foreman 3.10.1, 3.11.2, 3.12.0 GitHub PR puppet-pulpcore#357 #### CVE-2024-7012: Authentication bypass in Foreman An authentication bypass vulnerability has been identified in Foreman when deployed by the Foreman Installer with External Authentication. This issue arises from the way Apache is configured to do certificate authentication and pass this information to the Puma backend, without unsetting all headers coming from a possibly malicious client. Affects Foreman 2.2.0 and higher Fix released in Foreman 3.10.1, 3.11.2, 3.12.0 GitHub PR puppet-foreman#1181 Further References: [1] https://community.theforeman.org/t/foreman-3-11-2-is-now-available/39370 [2] https://theforeman.org/security.html#2024-7923 [3] https://access.redhat.com/security/cve/CVE-2024-7012 [4] https://access.redhat.com/security/cve/CVE-2024-7923 https://projects.theforeman.org/issues/37786?tab=changesets https://projects.theforeman.org/issues/37787?tab=changesets

Kind regards, Christian

A potential XSS issue within Foreman / Katello has been reported. It is possible to inject JavaScript code into the Description field of a User and save it. This code is then executed when opening certain pages (e.g., Host Collections).

Description of problem:

The foreman & Katello projects received an upstream notification about the discovery of an authenticated sql injection vulnerability within katello:

Dear Katello/Foreman Team,

During an internal test it was discovered that the scoped search parameters sortby and sortorder are vulnerable to an authenticated SQL injection.

If we access: https://x.x.x.x/katello/api/v2/organizations/1/syncplans/1/products?availablefor=syncplan&fullresult=true&page=1&search=&sortby=name&sortorder=ASC'

we will see the following error:

{"displayMessage":"PG::Error: ERROR: unterminated quoted string at or near \"', katelloproducts.id <http://katelloproducts.id> DESC\"\nLINE 1: ...nid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katello...\n ^\n: SELECT \"katelloproducts\". FROM \"katelloproducts\" WHERE \"katelloproducts\".\"id\" IN (SELECT DISTINCT \"katelloproducts\".\"id\" FROM \"katelloproducts\" WHERE \"katelloproducts\".\"organizationid\" = 1 AND (katelloproducts.id <http://katelloproducts.id> in (NULL) or katelloproducts.id <http://katelloproducts.id> in (6,5,4,2,3,1)) AND (syncplanid != '1' OR syncplanid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katelloproducts.id <http://katelloproducts.id> DESC","errors":["PG::Error: ERROR: unterminated quoted string at or near \"', katelloproducts.id <http://katelloproducts.id> DESC\"\nLINE 1: ...nid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katello...\n

The injection can be exploited as a blind time based injection.

Best Regards Oliver

External reference: The line of code in question here is: https://github.com/Katello/katello/blob/KATELLO-3.0/app/controllers/katello/api/v2/apicontroller.rb#L67

Jan Rusnacko of Red Hat reports:

Katello code exposes potential tosym Denial of Service attack vector from user input parameters. The two places identified are:

https://github.com/Katello/katello/blob/9231e24f93fa804e557fc95637cfa2c5bb92f6a7/app/controllers/katello/contentsearchcontroller.rb#L617

https://github.com/Katello/katello/blob/9231e24f93fa804e557fc95637cfa2c5bb92f6a7/app/controllers/katello/api/apicontroller.rb#L87

This type of attack is documented here - http://docs.fedoraproject.org/en-US/FedoraSecurityTeam/1/html/SecureRubyDevelopmentGuide/RubySymbols.html

This has been confirmed in testing by Eric Helms of Red Hat.

Dominic Cleal reports:

/etc/pki/tls/private/katello-node.key is created in the apache::certs class in node-installer when a child Pulp node is deployed.

It contains the private key for the node, that's normally kept in files with 0600 permissions.

Hayk Hovsepyan hhovsepy reports:

When user without remove system permissions calls CLI command "system removedeletion", it finishes successfully without any warning.

modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.

Aaron Weitekamp (aweiteka) reports:

Description of problem: /etc/katello/secure/passphrase is world readable. File and directory should be secured. [root@qeblade40 ~]# ls -la /etc/katello/secure total 12 drwxr-xr-x. 2 root root 4096 Nov 13 09:11 . drwxr-xr-x. 3 root root 4096 Nov 14 11:22 .. -rw-r--r--. 1 root root 65 Nov 13 09:11 passphrase [root@qeblade40 ~]# rpm -qf /etc/katello/secure katello-selinux-1.1.1-2.el6cf.noarch [root@qeblade40 ~]# rpm -qf /etc/katello/secure/passphrase file /etc/katello/secure/passphrase is not owned by any package

Version-Release number of selected component (if applicable): 1.1 [root@qeblade40 ~]# rpm -qa |grep katello katello-cli-1.1.8-12.el6cf.noarch katello-1.1.12-22.el6cf.noarch katello-qpid-broker-key-pair-1.0-1.noarch katello-certs-tools-1.1.8-1.el6cf.noarch katello-candlepin-cert-key-pair-1.0-1.noarch katello-glue-pulp-1.1.12-22.el6cf.noarch katello-all-1.1.12-22.el6cf.noarch katello-cli-common-1.1.8-12.el6cf.noarch katello-glue-candlepin-1.1.12-22.el6cf.noarch katello-selinux-1.1.1-2.el6cf.noarch katello-qpid-client-key-pair-1.0-1.noarch katello-common-1.1.12-22.el6cf.noarch katello-configure-1.1.9-12.el6cf.noarch

Steps to Reproduce: 1. ls -la /etc/katello/secure 2. rpm -qf /etc/katello/secure Actual results: File and directory are world readable

Aaron Weitekamp (aweiteka) reports:

Description of problem: /etc/katello/secure/passphrase is world readable. File and directory should be secured. [root@qeblade40 ~]# ls -la /etc/katello/secure total 12 drwxr-xr-x. 2 root root 4096 Nov 13 09:11 . drwxr-xr-x. 3 root root 4096 Nov 14 11:22 .. -rw-r--r--. 1 root root 65 Nov 13 09:11 passphrase [root@qeblade40 ~]# rpm -qf /etc/katello/secure katello-selinux-1.1.1-2.el6cf.noarch [root@qeblade40 ~]# rpm -qf /etc/katello/secure/passphrase file /etc/katello/secure/passphrase is not owned by any package

Version-Release number of selected component (if applicable): 1.1 [root@qeblade40 ~]# rpm -qa |grep katello katello-cli-1.1.8-12.el6cf.noarch katello-1.1.12-22.el6cf.noarch katello-qpid-broker-key-pair-1.0-1.noarch katello-certs-tools-1.1.8-1.el6cf.noarch katello-candlepin-cert-key-pair-1.0-1.noarch katello-glue-pulp-1.1.12-22.el6cf.noarch katello-all-1.1.12-22.el6cf.noarch katello-cli-common-1.1.8-12.el6cf.noarch katello-glue-candlepin-1.1.12-22.el6cf.noarch katello-selinux-1.1.1-2.el6cf.noarch katello-qpid-client-key-pair-1.0-1.noarch katello-common-1.1.12-22.el6cf.noarch katello-configure-1.1.9-12.el6cf.noarch

Steps to Reproduce: 1. ls -la /etc/katello/secure 2. rpm -qf /etc/katello/secure Actual results: File and directory are world readable

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secrettoken value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secrettoken.