Red Hat Security Advisory

RHSA-2017:1601

CFME 5.7.3 security, bug fix and enhancement update

Released 2017-06-28 · Red Hat rating Important · View on Red Hat →

Fixed in

CloudForms Management Engine 5.7 cfme-5.7.3.2-1.el7cf, cfme-appliance-5.7.3.2-1.el7cf, cfme-gemset-5.7.3.2-1.el7cf +4

TI-2016-03832 CVE-2016-4457 · GHSA-83f5-53jx-3mvf

LOW 35

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01058 Published 2017-06-08 Fixed CWE-310

TI-2016-06058 CVE-2016-7047 · GHSA-2499-9m7g-hrw5

LOW 23

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01334 Published 2018-09-11 Fixed CWE-200

TI-2017-05142 CVE-2017-7497 · GHSA-97vg-m3qf-f423

LOW 22

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00991 Published 2018-07-27 Fixed CWE-284