CVE-2016-7040
Fixed in a distro release EPSS 2%
Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.
Products: redhat cloudforms_management_engine
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat cloudforms managementengine 5.6 | cfme | 0:5.6.2.1-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | cfme-appliance | 0:5.6.2.1-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | cfme-appliance-debuginfo | 0:5.6.2.1-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | cfme-debuginfo | 0:5.6.2.1-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | cfme-gemset | 0:5.6.2.1-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | rh-ruby22-rubygem-nokogiri | 0:1.6.8-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | rh-ruby22-rubygem-nokogiri-debuginfo | 0:1.6.8-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | rh-ruby22-rubygem-pkg-config | 0:1.1.7-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | rh-ruby22-rubygem-pkg-config-doc | 0:1.1.7-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | rh-ruby22-rubygem-thin | 0:1.7.0-1.el7cf |
| Red Hat cloudforms managementengine 5.6 | rh-ruby22-rubygem-thin-debuginfo | 0:1.7.0-1.el7cf |