Read the docs
TI-2024-07345 Aliases CVE-2024-7923GHSA-pmjc-mxf4-8qwx

Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

Priority MEDIUM 50CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00814 57th percentileScored 2026-11-07
Fix Fixed pulpcore: 22.0Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—pulpcorebefore 22.022.0Patch availableCNA
Red HatRed Hat Satellite 6.13 for RHEL 8—1:3.5.2.8-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.13 for RHEL 8—1:3.5.2.8-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.14 for RHEL 8—1:3.7.0.8-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.14 for RHEL 8—1:3.7.0.8-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.15 for RHEL 8—1:3.9.3.4-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.15 for RHEL 8—1:3.9.3.4-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 8—1:3.12.0.1-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 8—1:3.12.0.1-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 9—1:3.12.0.1-1.el9satPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 9—1:3.12.0.1-1.el9satPatch availableCNA
Red HatRed Hat Update Infrastructure 4 for Cloud Providers——Not affectedCNA
Red HatRed Hat Update Infrastructure 4 for Cloud Providers——Not affectedCNA
Red HatRed Hat Update Infrastructure 4 for Cloud Providers——Not affectedCNA
  • pulpcore Vendor— Affected before 22.0 Fixed in 22.0 Patch available CNA
  • Red Hat Satellite 6.13 for RHEL 8 VendorRed Hat Affected — Fixed in 1:3.5.2.8-1.el8sat Patch available CNA
  • Red Hat Satellite 6.13 for RHEL 8 VendorRed Hat Affected — Fixed in 1:3.5.2.8-1.el8sat Patch available CNA
  • Red Hat Satellite 6.14 for RHEL 8 VendorRed Hat Affected — Fixed in 1:3.7.0.8-1.el8sat Patch available CNA
  • Red Hat Satellite 6.14 for RHEL 8 VendorRed Hat Affected — Fixed in 1:3.7.0.8-1.el8sat Patch available CNA
  • Red Hat Satellite 6.15 for RHEL 8 VendorRed Hat Affected — Fixed in 1:3.9.3.4-1.el8sat Patch available CNA
  • Red Hat Satellite 6.15 for RHEL 8 VendorRed Hat Affected — Fixed in 1:3.9.3.4-1.el8sat Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 8 VendorRed Hat Affected — Fixed in 1:3.12.0.1-1.el8sat Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 8 VendorRed Hat Affected — Fixed in 1:3.12.0.1-1.el8sat Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 9 VendorRed Hat Affected — Fixed in 1:3.12.0.1-1.el9sat Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 9 VendorRed Hat Affected — Fixed in 1:3.12.0.1-1.el9sat Patch available CNA
  • Red Hat Update Infrastructure 4 for Cloud Providers VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Update Infrastructure 4 for Cloud Providers VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Update Infrastructure 4 for Cloud Providers VendorRed Hat Affected — Fixed in — Not affected CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:satellite:6.13:*:*:*:*:*:*:*6.13VulnerableRed Hat
cpe:2.3:a:redhat:satellite:6.14:*:*:*:*:*:*:*6.14VulnerableRed Hat
cpe:2.3:a:redhat:satellite:6.15:*:*:*:*:*:*:*6.15VulnerableRed Hat
  • cpe:2.3:a:redhat:satellite:6.13:*:*:*:*:*:*:* Versions 6.13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:6.14:*:*:*:*:*:*:* Versions 6.14 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:6.15:*:*:*:*:*:*:* Versions 6.15 Vulnerable ·Red Hat

Remediation

  • Fix · CNA pulpcore Fixed in 22.0

Red Hat 4 advisories

  • RHSA-2024:8906 Released 2024-11-05 · Red Hat rating Critical
    Satellite 6.16.0 release
    • Red Hat Satellite 6.16 for RHEL 8 ansible-collection-redhat-satellite-4.2.0-1.el8sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el8sat, ansible-lint-5.4.0-1.el8pc +47
    • Red Hat Satellite 6.16 for RHEL 9 ansible-collection-redhat-satellite-4.2.0-1.el9sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el9sat, ansible-runner-2.2.1-5.el9pc +47
  • RHSA-2024:6337 Released 2024-09-04 · Red Hat rating Important
    Satellite 6.13.7.2 Security Update
    • Red Hat Satellite 6.13 for RHEL 8 foreman-installer-1:3.5.2.8-1.el8sat, foreman-installer-katello-1:3.5.2.8-1.el8sat
  • RHSA-2024:6336 Released 2024-09-04 · Red Hat rating Important
    Satellite 6.14.4.2 Security Update
    • Red Hat Satellite 6.14 for RHEL 8 foreman-installer-1:3.7.0.8-1.el8sat, foreman-installer-katello-1:3.7.0.8-1.el8sat
Show 1 more Red Hat advisories
  • RHSA-2024:6335 Released 2024-09-04 · Red Hat rating Important
    Satellite 6.15.3.1 Security Update
    • Red Hat Satellite 6.15 for RHEL 8 foreman-installer-1:3.9.3.4-1.el8sat, foreman-installer-katello-1:3.9.3.4-1.el8sat

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Satellite 6.13 for RHEL 8, Red Hat Satellite 6.14 for RHEL 8 and 3 more products — RHSA-2024:6335

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2024-06507 Puppet-foreman: an authentication bypass vulnerability exists in foremanPriority MEDIUM 50
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Satellite 6.13 for RHEL 8, Red Hat Satellite 6.14 for RHEL 8 and 3 more products — RHSA-2024:6336

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2024-06507 Puppet-foreman: an authentication bypass vulnerability exists in foremanPriority MEDIUM 50
    Show all 2 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat Satellite 6.13 for RHEL 8, Red Hat Satellite 6.14 for RHEL 8 and 3 more products — RHSA-2024:6337

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2024-06507 Puppet-foreman: an authentication bypass vulnerability exists in foremanPriority MEDIUM 50
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6.13 for RHEL 8Fixed RHSA-2024:6337
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2024:6336
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2024:6335
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2024:8906
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2024:8906
Not affected: 6 products
  • Red Hat Satellite 6.13 for RHEL 8
  • Red Hat Satellite 6.14 for RHEL 8
  • Red Hat Satellite 6.15 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Update Infrastructure 4 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7923
  2. 2026-10-03 Alias added: GHSA-pmjc-mxf4-8qwx

References

Advisory 5

Other 1

  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-35991 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks KEVCVSS 3.1MEDIUM 6.5
  • TI-2015-04118 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers… KEVCVSS 3.1MEDIUM 5.3
  • TI-2018-07743 It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface… CVSS 3.0CRITICAL 9.8
See all 242 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences