Skip to content

Latest commit

 

History

History
125 lines (77 loc) · 6.7 KB

security.md

File metadata and controls

125 lines (77 loc) · 6.7 KB
Raw
layout title
default
Security

Security process

We take security issues seriously and welcome responsible disclosure from researchers discovering vulnerabilities in Foreman. Please email foreman-security@googlegroups.com (a private address for the security team) with all reports.

We will endeavour to resolve high severity issues in the current stable release and lower severity issues in the next major release. Announcements of security issues will be made on foreman-announce when a release containing a fix is available to end users and credit will be given to the researcher if desired.

Security advisories

All security advisories made for Foreman are listed below with their corresponding CVE identifier.

Disclosure details

CVE-2013-4386: SQL injection in host/host group parameter overrides

Host and host group parameter overrides (lookup_values) allowed SQL injection from the host FQDN or host group label.

  • Fix released in Foreman 1.2.3
  • Redmine issue #3160
  • Red Hat Bugzilla #1013076

CVE-2013-4182: hosts API privilege escalation

The /api/hosts API was found to provide access to all hosts without checking whether the current user has privileges to view a particular host.

Thanks to Daniel Lobato of CERN IT-PES-PS for discovering this issue.

  • Fix released in Foreman 1.2.2
  • Redmine issue #2863
  • Red Hat Bugzilla #990374

CVE-2013-4180: DoS via hosts controller input conversion

Power and IPMI boot actions converted user input to symbols, which could lead to memory exhaustion.

Thanks to Marek Hulan of the Red Hat Foreman Team for discovering this issue.

  • Fix released in Foreman 1.2.2
  • Redmine issue #2860
  • Red Hat Bugzilla #989755

CVE-2013-2121: bookmarks remote code execution

Bookmarks could be created in Foreman containing data that was later executed arbitrarily when reading the bookmark.

Thanks to Ramon de C Valle of the Red Hat Product Security Team for discovering this issue.

  • Fix released in Foreman 1.2.0
  • Redmine issue #2631
  • Red Hat Bugzilla #968166

CVE-2013-2113: admin user creation, privilege escalation

Non-admin user with permissions to create or edit other users were able to change the admin flag, or assign roles that they themselves do not have, enabling a privilege escalation.

Thanks to Ramon de C Valle of the Red Hat Product Security Team for discovering this issue.

  • Fix released in Foreman 1.2.0
  • Redmine issue #2630
  • Red Hat Bugzilla #966804

CVE-2013-0210: Arbitrary command execution risk in smart proxy

Requests to the smart proxy Puppet run API were not properly escaped when running the Puppet command, leading to possible arbitrary command execution.

  • Fix released in Foreman 1.2.0

CVE-2013-0187: XMLHttpRequest bypasses authorization

XMLHttpRequest or AJAX requests to Foreman were not subject to authorization checks, enabling privilege escalation for authenticated users.

  • Fix released in Foreman 1.1

CVE-2013-0174: exposed hashed root passwords can be retrieved by unauthenticated remote users

The external node classifier (ENC) API in Foreman was accessible to any remote host and the output would contain the hashed root psasword (used for unattended installation). Authentication and authorization features were added to the ENC API to secure this data.

Thanks to Andreas Rogge for discovering this issue.

  • Fix released in Foreman 1.1
  • Redmine issue #2069

CVE-2013-0173: insecure fixed salt "foreman" for passwords

The salt used to hash root passwords (used for unattended installation) was fixed to the string "foreman" instead of being randomized.

  • Fix released in Foreman 1.1
  • Redmine issue #2069

CVE-2013-0171: import allows unauthenticated YAML uploads/parsing leading to arbitrary code execution

Fact and report import APIs in Foreman were accessible to any remote host and accepted YAML input, allowing arbitrary objects to be created on the Foreman server via YAML. Authentication and authorization features were added to the import APIs to prevent this.

  • Fix released in Foreman 1.1
  • Redmine issue #2121

CVE-2012-5648: SQL injection through search mechanism

Input to the search mechanism in Foreman was not escaped when constructing queries, enabling SQL injection into the resulting query.

  • Fix released in Foreman 1.0.2

CVE-2012-5477: world writable files in smart proxy

The smart proxy daemon ran with a umask of 0, causing files and directories written by it to have world-writable bits set. Files managed by the smart proxy could be modified by local users on the same host.

  • Fix released in Foreman 1.1
  • Redmine issue #1929