Recherche « Theforeman foreman »

Red Hat Satellite 6.16 for RHEL 8 · Red Hat Satellite 6.16 for RHEL 9 · Red Hat Satellite 6.17 for RHEL 9 · Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

Red Hat Satellite 6.16 for RHEL 8 · Red Hat Satellite 6.16 for RHEL 9 · Red Hat Satellite 6.17 for RHEL 9 · Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

Red Hat Satellite 6.16 for RHEL 8 · Red Hat Satellite 6.16 for RHEL 9 · Red Hat Satellite 6.17 for RHEL 9 · Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

Red Hat Satellite 6.16 for RHEL 8 · Red Hat Satellite 6.16 for RHEL 9 · Red Hat Satellite 6.17 for RHEL 9 · Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.

Red Hat Satellite 6.16 for RHEL 8 · Red Hat Satellite 6.16 for RHEL 9 · Red Hat Satellite 6.17 for RHEL 9 · Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

Red Hat Satellite 6.16 for RHEL 8 · Red Hat Satellite 6.16 for RHEL 9 · Red Hat Satellite 6.17 for RHEL 9 · Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.