CVE-2015-5233
Fixed in a distro release EPSS 1%
Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.
Products: theforeman foreman, redhat satellite
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat satellite 6.1 | foreman | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite 6.1 | foreman | 0:1.7.2.49-1.el7sat |
| Red Hat satellite 6.1 | foreman-compute | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite 6.1 | foreman-compute | 0:1.7.2.49-1.el7sat |
| Red Hat satellite 6.1 | foreman-debug | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite 6.1 | foreman-debug | 0:1.7.2.49-1.el7sat |
| Red Hat satellite 6.1 | foreman-discovery-image | 1:3.0.5-3.el7sat |
| Red Hat satellite 6.1 | foreman-gce | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite 6.1 | foreman-gce | 0:1.7.2.49-1.el7sat |
| Red Hat satellite 6.1 | foreman-libvirt | 0:1.7.2.49-1.el7sat |
| Red Hat satellite 6.1 | foreman-libvirt | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite 6.1 | foreman-ovirt | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite 6.1 | foreman-ovirt | 0:1.7.2.49-1.el7sat |
| Red Hat satellite 6.1 | foreman-postgresql | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite 6.1 | foreman-postgresql | 0:1.7.2.49-1.el7sat |
| Red Hat satellite 6.1 | foreman-proxy | 0:1.7.2.7-1.el7sat |
| Red Hat satellite 6.1 | foreman-proxy | 0:1.7.2.7-1.el6 |
| Red Hat satellite 6.1 | foreman-vmware | 0:1.7.2.49-1.el7sat |
| Red Hat satellite 6.1 | foreman-vmware | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite 6.1 | gofer | 0:2.6.8-1.el7sat |
| Red Hat satellite 6.1 | gofer | 0:2.6.8-1.el6 |
| Red Hat satellite 6.1 | katello-agent | 0:2.2.6-1.el7sat |
| Red Hat satellite 6.1 | katello-agent | 0:2.2.6-1.el6 |
| Red Hat satellite 6.1 | katello-installer | 0:2.3.22-1.el7sat |
| Red Hat satellite 6.1 | katello-installer | 0:2.3.22-1.el6 |
| Red Hat satellite 6.1 | katello-installer-base | 0:2.3.22-1.el6 |
| Red Hat satellite 6.1 | katello-installer-base | 0:2.3.22-1.el7sat |
| Red Hat satellite 6.1 | libqpid-dispatch | 0:0.4-11.el6 |
| Red Hat satellite 6.1 | libqpid-dispatch | 0:0.4-11.el7 |
| Red Hat satellite 6.1 | python-gofer | 0:2.6.8-1.el6 |
| Red Hat satellite 6.1 | python-gofer | 0:2.6.8-1.el7sat |
| Red Hat satellite 6.1 | python-gofer-proton | 0:2.6.8-1.el7sat |
| Red Hat satellite 6.1 | python-gofer-proton | 0:2.6.8-1.el6 |
| Red Hat satellite 6.1 | python-gofer-qpid | 0:2.6.8-1.el6 |
| Red Hat satellite 6.1 | python-gofer-qpid | 0:2.6.8-1.el7sat |
| Red Hat satellite 6.1 | python-nectar | 0:1.3.4-1.el7sat |
| Red Hat satellite 6.1 | python-nectar | 0:1.3.4-1.el6 |
| Red Hat satellite 6.1 | python-qpid | 0:0.30-7.el6 |
| Red Hat satellite 6.1 | python-qpid | 0:0.30-7.el7 |
| Red Hat satellite 6.1 | python-qpid-proton | 0:0.9-11.el6 |
| Red Hat satellite 6.1 | python-qpid-proton | 0:0.9-11.el7 |
| Red Hat satellite 6.1 | qpid-dispatch | 0:0.4-11.el7 |
| Red Hat satellite 6.1 | qpid-dispatch | 0:0.4-11.el6 |
| Red Hat satellite 6.1 | qpid-dispatch-debuginfo | 0:0.4-11.el7 |
| Red Hat satellite 6.1 | qpid-dispatch-debuginfo | 0:0.4-11.el6 |
| Red Hat satellite 6.1 | qpid-dispatch-router | 0:0.4-11.el7 |
| Red Hat satellite 6.1 | qpid-dispatch-router | 0:0.4-11.el6 |
| Red Hat satellite 6.1 | qpid-dispatch-tools | 0:0.4-11.el7 |
| Red Hat satellite 6.1 | qpid-dispatch-tools | 0:0.4-11.el6 |
| Red Hat satellite 6.1 | qpid-proton | 0:0.9-11.el6 |
| Red Hat satellite 6.1 | qpid-proton | 0:0.9-11.el7 |
| Red Hat satellite 6.1 | qpid-proton-c | 0:0.9-11.el6 |
| Red Hat satellite 6.1 | qpid-proton-c | 0:0.9-11.el7 |
| Red Hat satellite 6.1 | qpid-proton-debuginfo | 0:0.9-11.el6 |
| Red Hat satellite 6.1 | qpid-proton-debuginfo | 0:0.9-11.el7 |
| Red Hat satellite 6.1 | ruby193-rubygem-foreman-redhat_access | 0:0.2.4-1.el6_6sat |
| Red Hat satellite 6.1 | ruby193-rubygem-foreman-redhat_access | 0:0.2.4-1.el7sat |
| Red Hat satellite 6.1 | ruby193-rubygem-foreman_bootdisk | 0:4.0.2.14-1.el7sat |
| Red Hat satellite 6.1 | ruby193-rubygem-foreman_bootdisk | 0:4.0.2.14-1.el6_6sat |
| Red Hat satellite 6.1 | ruby193-rubygem-foreman_discovery | 0:2.0.0.23-1.el6_6sat |
| Red Hat satellite 6.1 | ruby193-rubygem-foreman_discovery | 0:2.0.0.23-1.el7sat |
| Red Hat satellite 6.1 | ruby193-rubygem-katello | 0:2.2.0.77-1.el6_6sat |
| Red Hat satellite 6.1 | ruby193-rubygem-katello | 0:2.2.0.77-1.el7sat |
| Red Hat satellite 6.1 | ruby193-rubygem-redhat_access_lib | 0:0.0.6-1.el7sat |
| Red Hat satellite 6.1 | ruby193-rubygem-redhat_access_lib | 0:0.0.6-1.el6_6sat |
| Red Hat satellite 6.1 | rubygem-hammer_cli_foreman_docker | 0:0.0.3.10-1.el7sat |
| Red Hat satellite 6.1 | rubygem-hammer_cli_foreman_docker | 0:0.0.3.10-1.el6 |
| Red Hat satellite 6.1 | rubygem-hammer_cli_foreman_docker-doc | 0:0.0.3.10-1.el7sat |
| Red Hat satellite 6.1 | rubygem-hammer_cli_foreman_docker-doc | 0:0.0.3.10-1.el6 |
| Red Hat satellite 6.1 | rubygem-newt | 0:0.9.6-1.el7sat |
| Red Hat satellite 6.1 | rubygem-newt | 0:0.9.6-1.el6 |
| Red Hat satellite 6.1 | rubygem-newt-debuginfo | 0:0.9.6-1.el7sat |
| Red Hat satellite 6.1 | rubygem-newt-debuginfo | 0:0.9.6-1.el6 |
| Red Hat satellite 6.1 | rubygem-smart_proxy_discovery | 0:1.0.3-2.el6 |
| Red Hat satellite 6.1 | rubygem-smart_proxy_discovery | 0:1.0.3-2.el7sat |
| Red Hat satellite 6.1 | rubygem-smart_proxy_discovery_image | 0:1.0.5-3.el6 |
| Red Hat satellite 6.1 | rubygem-smart_proxy_discovery_image | 0:1.0.5-3.el7sat |
| Red Hat satellite capsule 6.1 | capsule-installer | 0:2.3.22-1.el6 |
| Red Hat satellite capsule 6.1 | capsule-installer | 0:2.3.22-1.el7sat |
| Red Hat satellite capsule 6.1 | foreman | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite capsule 6.1 | foreman | 0:1.7.2.49-1.el7sat |
| Red Hat satellite capsule 6.1 | foreman-debug | 0:1.7.2.49-1.el7sat |
| Red Hat satellite capsule 6.1 | foreman-debug | 0:1.7.2.49-1.el6_6sat |
| Red Hat satellite capsule 6.1 | foreman-discovery-image | 1:3.0.5-3.el7sat |
| Red Hat satellite capsule 6.1 | foreman-proxy | 0:1.7.2.7-1.el7sat |
| Red Hat satellite capsule 6.1 | foreman-proxy | 0:1.7.2.7-1.el6 |
| Red Hat satellite capsule 6.1 | gofer | 0:2.6.8-1.el7sat |
| Red Hat satellite capsule 6.1 | gofer | 0:2.6.8-1.el6 |
| Red Hat satellite capsule 6.1 | katello-agent | 0:2.2.6-1.el7sat |
| Red Hat satellite capsule 6.1 | katello-agent | 0:2.2.6-1.el6 |
| Red Hat satellite capsule 6.1 | katello-installer-base | 0:2.3.22-1.el6 |
| Red Hat satellite capsule 6.1 | katello-installer-base | 0:2.3.22-1.el7sat |
| Red Hat satellite capsule 6.1 | libqpid-dispatch | 0:0.4-11.el6 |
| Red Hat satellite capsule 6.1 | libqpid-dispatch | 0:0.4-11.el7 |
| Red Hat satellite capsule 6.1 | python-gofer | 0:2.6.8-1.el7sat |
| Red Hat satellite capsule 6.1 | python-gofer | 0:2.6.8-1.el6 |
| Red Hat satellite capsule 6.1 | python-gofer-proton | 0:2.6.8-1.el7sat |
| Red Hat satellite capsule 6.1 | python-gofer-proton | 0:2.6.8-1.el6 |
| Red Hat satellite capsule 6.1 | python-gofer-qpid | 0:2.6.8-1.el6 |
| Red Hat satellite capsule 6.1 | python-gofer-qpid | 0:2.6.8-1.el7sat |
| Red Hat satellite capsule 6.1 | python-nectar | 0:1.3.4-1.el6 |
| Red Hat satellite capsule 6.1 | python-nectar | 0:1.3.4-1.el7sat |
| Red Hat satellite capsule 6.1 | python-qpid | 0:0.30-7.el7 |
| Red Hat satellite capsule 6.1 | python-qpid | 0:0.30-7.el6 |
| Red Hat satellite capsule 6.1 | python-qpid-proton | 0:0.9-11.el7 |
| Red Hat satellite capsule 6.1 | python-qpid-proton | 0:0.9-11.el6 |
| Red Hat satellite capsule 6.1 | qpid-dispatch | 0:0.4-11.el7 |
| Red Hat satellite capsule 6.1 | qpid-dispatch | 0:0.4-11.el6 |
| Red Hat satellite capsule 6.1 | qpid-dispatch-debuginfo | 0:0.4-11.el7 |
| Red Hat satellite capsule 6.1 | qpid-dispatch-debuginfo | 0:0.4-11.el6 |
| Red Hat satellite capsule 6.1 | qpid-dispatch-router | 0:0.4-11.el7 |
| Red Hat satellite capsule 6.1 | qpid-dispatch-router | 0:0.4-11.el6 |
| Red Hat satellite capsule 6.1 | qpid-proton | 0:0.9-11.el6 |
| Red Hat satellite capsule 6.1 | qpid-proton | 0:0.9-11.el7 |
| Red Hat satellite capsule 6.1 | qpid-proton-c | 0:0.9-11.el6 |
| Red Hat satellite capsule 6.1 | qpid-proton-c | 0:0.9-11.el7 |
| Red Hat satellite capsule 6.1 | qpid-proton-debuginfo | 0:0.9-11.el6 |
| Red Hat satellite capsule 6.1 | qpid-proton-debuginfo | 0:0.9-11.el7 |
| Red Hat satellite capsule 6.1 | rubygem-hammer_cli_foreman_docker | 0:0.0.3.10-1.el7sat |
| Red Hat satellite capsule 6.1 | rubygem-hammer_cli_foreman_docker-doc | 0:0.0.3.10-1.el7sat |
| Red Hat satellite capsule 6.1 | rubygem-smart_proxy_discovery | 0:1.0.3-2.el6 |
| Red Hat satellite capsule 6.1 | rubygem-smart_proxy_discovery | 0:1.0.3-2.el7sat |
| Red Hat satellite capsule 6.1 | rubygem-smart_proxy_discovery_image | 0:1.0.5-3.el6 |
| Red Hat satellite capsule 6.1 | rubygem-smart_proxy_discovery_image | 0:1.0.5-3.el7sat |