CVE-2016-5402
Fixed in a distro release EPSS 6%CVSS 8.8
A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.
Products: redhat cloudforms, redhat cloudforms_management_engine
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat cloudforms managementengine 5.6 | cfme | 0:5.6.3.3-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | cfme-appliance | 0:5.6.3.3-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | cfme-appliance-debuginfo | 0:5.6.3.3-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | cfme-debuginfo | 0:5.6.3.3-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | cfme-gemset | 0:5.6.3.3-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | freeipmi | 0:1.5.1-2.el7cf |
| Red Hat cloudforms managementengine 5.6 | freeipmi-bmc-watchdog | 0:1.5.1-2.el7cf |
| Red Hat cloudforms managementengine 5.6 | freeipmi-debuginfo | 0:1.5.1-2.el7cf |
| Red Hat cloudforms managementengine 5.6 | freeipmi-devel | 0:1.5.1-2.el7cf |
| Red Hat cloudforms managementengine 5.6 | freeipmi-ipmidetectd | 0:1.5.1-2.el7cf |
| Red Hat cloudforms managementengine 5.6 | freeipmi-ipmiseld | 0:1.5.1-2.el7cf |