Red Hat Security Advisory

RHSA-2013:0545

CloudForms Cloud Engine 1.1.2 update

Released 2013-02-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

CloudForms Cloud Engine for RHEL 6 Server aeolus-all-0.13.26-1.el6cf, aeolus-conductor-0.13.26-1.el6cf, aeolus-conductor-daemons-0.13.26-1.el6cf +7

Fixes 3 records

TI-2012-05082 CVE-2012-6118 · GHSA-9xm6-w668-ghmv

The Administer tab in Aeolus Conductor allows remote authenticated users to bypass…

LOW 27

The Administer tab in Aeolus Conductor allows remote authenticated users to bypass intended quota restrictions by updating the Maximum Running Instances quota user setting.

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.01177 Published 2013-03-12 Fixed CWE-264

TI-2012-05081 CVE-2012-6117 · GHSA-58x3-gjpx-27qx

Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2…

LOW 12

Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext password…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00474 Published 2013-03-12 Fixed CWE-264

TI-2012-04628 CVE-2012-5509 · GHSA-4m29-g7f4-9v6x

aeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat…

LOW 12

aeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for a temporary file in /tmp, which allows local users to read creden…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00431 Published 2013-03-12 Fixed CWE-264