CVE-2018-14643
Fixed in a distro release EPSS 6%CVSS 9.8
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
Products: theforeman foreman
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | smart_proxy_dynflow | 0.2.1 |
| RubyGems | smart_proxy_dynflow | 0.1.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat satellite 6.3 | rubygem-smart_proxy_dynflow | 0:0.1.10.2-1.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-smart_proxy_dynflow | 0:0.1.10.2-1.el7sat |