Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-40348

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.

Published

2021-11-01T05:15:07.007

Last Modified

2024-11-21T06:23:55.370

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

10.0

Weaknesses

Type: Primary
CWE-94

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	uyuni-project	uyuni	2021.08	Yes
Application	spacewalk_project	spacewalk	2.10	Yes

References

http://www.openwall.com/lists/oss-security/2021/10/28/4 Exploit, Mailing List, Patch, Third Party Advisory ([email protected])
https://github.com/uyuni-project/uyuni/commit/790c7388efac6923c5475e01c1ff718dffa9f052 Patch, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/10/28/4 Exploit, Mailing List, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/uyuni-project/uyuni/commit/790c7388efac6923c5475e01c1ff718dffa9f052 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)