Red Hat Security AdvisoryRHSA-2015:0729
setroubleshoot security update
Released 2015-03-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) setroubleshoot-2.0.5-7.el5_11, setroubleshoot-server-2.0.5-7.el5_11
- Red Hat Enterprise Linux Client (v. 7) setroubleshoot-3.2.17-4.1.el7_1, setroubleshoot-server-3.2.17-4.1.el7_1
- Red Hat Enterprise Linux Desktop (v. 5 client) setroubleshoot-2.0.5-7.el5_11, setroubleshoot-server-2.0.5-7.el5_11
- Red Hat Enterprise Linux Desktop (v. 6) setroubleshoot-3.0.47-6.el6_6.1, setroubleshoot-server-3.0.47-6.el6_6.1
- Red Hat Enterprise Linux Desktop Optional (v. 6) setroubleshoot-doc-3.0.47-6.el6_6.1
- Red Hat Enterprise Linux Server (v. 6) setroubleshoot-3.0.47-6.el6_6.1, setroubleshoot-server-3.0.47-6.el6_6.1
- Red Hat Enterprise Linux Server (v. 7) setroubleshoot-3.2.17-4.1.ael7b_1, setroubleshoot-3.2.17-4.1.el7_1, setroubleshoot-server-3.2.17-4.1.ael7b_1 +1
- Red Hat Enterprise Linux Server Optional (v. 6) setroubleshoot-doc-3.0.47-6.el6_6.1
- Red Hat Enterprise Linux Workstation (v. 6) setroubleshoot-3.0.47-6.el6_6.1, setroubleshoot-server-3.0.47-6.el6_6.1
- Red Hat Enterprise Linux Workstation (v. 7) setroubleshoot-3.2.17-4.1.el7_1, setroubleshoot-server-3.2.17-4.1.el7_1
- Red Hat Enterprise Linux Workstation Optional (v. 6) setroubleshoot-doc-3.0.47-6.el6_6.1
- Red Hat Virtualization 4 Hypervisor for RHEL 7 setroubleshoot-3.2.17-4.1.el7_1, setroubleshoot-server-3.2.17-4.1.el7_1
Fixes 1 record
Priority MEDIUM 59
The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.16463 · Published 2015-03-30 · Fixed CWE-77
