Red Hat Security Advisory

RHSA-2017:1259

spacewalk-backend security update

Released 2017-05-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Satellite 5.6 (RHEL v.5) spacewalk-backend-2.0.3-45.el5sat, spacewalk-backend-app-2.0.3-45.el5sat, spacewalk-backend-applet-2.0.3-45.el5sat +14
Red Hat Satellite 5.6 (RHEL v.6) spacewalk-backend-2.0.3-45.el6sat, spacewalk-backend-app-2.0.3-45.el6sat, spacewalk-backend-applet-2.0.3-45.el6sat +14
Red Hat Satellite 5.7 (RHEL v.6) spacewalk-backend-2.3.3-49.el6sat, spacewalk-backend-app-2.3.3-49.el6sat, spacewalk-backend-applet-2.3.3-49.el6sat +14

Fixes 1 record

TI-2017-05117 CVE-2017-7470 · GHSA-8hhp-cr56-3gg7

Incorrect authorization in [UNKNOWN] spacewalk-backend

MEDIUM 46

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02118 Published 2018-07-27 Fixed CWE-863