Red Hat Security AdvisoryRHSA-2013:1196
Foreman security update
Released 2013-09-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux OpenStack Platform 3.0 ruby193-foreman-1.1.10014-1.2.el6ost, ruby193-foreman-mysql-1.1.10014-1.2.el6ost
Fixes 2 records
Priority LOW 37
app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02395 · Published 2013-09-16 · Partial fix CWE-264
Priority LOW 27
The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02413 · Published 2013-09-16 · Partial fix CWE-20
