Red Hat Security Advisory

RHSA-2017:1758

Red Hat CloudForms security, bug fix, and enhancement update

Released 2017-08-02 · Red Hat rating Important · View on Red Hat →

Fixed in

CloudForms Management Engine 5.8 ansible-2.3.0.0-1.el7, ansible-tower-server-3.1.3-1.el7at, ansible-tower-setup-3.1.3-1.el7at +5

Fixes 4 records

TI-2017-05171 CVE-2017-7530 · GHSA-hvp5-xq7g-8w42

Missing authorization in Red Hat cfme

MEDIUM 41

In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is trigge…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01681 Published 2018-07-26 Fixed CWE-862

TI-2017-01910 CVE-2017-2664 · GHSA-rc49-fxf8-jgg2

Improper access control in Red Hat CloudForms

LOW 31

CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01302 Published 2018-07-26 Fixed CWE-284

TI-2016-06058 CVE-2016-7047 · GHSA-2499-9m7g-hrw5

Information disclosure in Red Hat cfme

LOW 23

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01334 Published 2018-09-11 Fixed CWE-200

TI-2017-05142 CVE-2017-7497 · GHSA-97vg-m3qf-f423

Improper access control in [UNKNOWN] CFME

LOW 22

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00991 Published 2018-07-27 Fixed CWE-284