DATABASE RESOURCES PRICING ABOUT US

{"id": "OPENVAS:1361412562310809122", "type": "openvas", "bulletinFamily": "scanner", "title": "Fedora Update for pulp-puppet FEDORA-2016-4373f7d32a", "description": "The remote host is missing an update for the ", "published": "2016-08-18T00:00:00", "modified": "2019-03-15T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310809122", "reporter": "Copyright (C) 2016 Greenbone Networks GmbH", "references": ["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVVYGGYGNEMADXS7A4ZIC5BUU5USDOKR", "2016-4373f7d32a"], "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "lastseen": "2019-05-29T18:35:36", "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3696", "CVE-2016-3704"]}, {"type": "fedora", "idList": ["FEDORA:230C060427A2", "FEDORA:2E63860427A5", "FEDORA:53D0B60427DD", "FEDORA:65DE36087BBD", "FEDORA:72BF86087C3B", "FEDORA:87A8B6087C4A"]}, {"type": "nessus", "idList": ["FEDORA_2016-4373F7D32A.NASL", "REDHAT-RHSA-2018-0336.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310809123", "OPENVAS:1361412562310809124", "OPENVAS:1361412562310809125", "OPENVAS:1361412562310809132", "OPENVAS:1361412562310809135"]}, {"type": "redhat", "idList": ["RHSA-2018:0336"]}], "rev": 4}, "score": {"value": -0.4, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2016-3696"]}, {"type": "fedora", "idList": ["FEDORA:65DE36087BBD"]}, {"type": "nessus", "idList": ["FEDORA_2016-4373F7D32A.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310809135"]}, {"type": "redhat", "idList": ["RHSA-2018:0336"]}]}, "exploitation": null, "vulnersScore": -0.4}, "pluginID": "1361412562310809122", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pulp-puppet FEDORA-2016-4373f7d32a\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.809122\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-08-18 05:56:42 +0200 (Thu, 18 Aug 2016)\");\n script_cve_id(\"CVE-2016-3696\", \"CVE-2016-3704\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for pulp-puppet FEDORA-2016-4373f7d32a\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'pulp-puppet'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"pulp-puppet on Fedora 24\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-4373f7d32a\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVVYGGYGNEMADXS7A4ZIC5BUU5USDOKR\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC24\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC24\")\n{\n\n if ((res = isrpmvuln(pkg:\"pulp-puppet\", rpm:\"pulp-puppet~2.8.6~2.fc24\", rls:\"FC24\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "naslFamily": "Fedora Local Security Checks", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647589307, "score": 1659709850}}

{"openvas": [{"lastseen": "2019-05-29T18:35:39", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2016-08-18T00:00:00", "id": "OPENVAS:1361412562310809123", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310809123", "type": "openvas", "title": "Fedora Update for pulp-rpm FEDORA-2016-4373f7d32a", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pulp-rpm FEDORA-2016-4373f7d32a\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.809123\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-08-18 05:57:02 +0200 (Thu, 18 Aug 2016)\");\n script_cve_id(\"CVE-2016-3696\", \"CVE-2016-3704\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for pulp-rpm FEDORA-2016-4373f7d32a\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'pulp-rpm'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"pulp-rpm on Fedora 24\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-4373f7d32a\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLOCACI4V6UXTBG4ZYCTYJMLDFCY2Z4Y\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC24\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC24\")\n{\n\n if ((res = isrpmvuln(pkg:\"pulp-rpm\", rpm:\"pulp-rpm~2.8.6~2.fc24\", rls:\"FC24\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:35:48", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2016-08-18T00:00:00", "id": "OPENVAS:1361412562310809135", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310809135", "type": "openvas", "title": "Fedora Update for pulp FEDORA-2016-4373f7d32a", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pulp FEDORA-2016-4373f7d32a\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.809135\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-08-18 05:56:33 +0200 (Thu, 18 Aug 2016)\");\n script_cve_id(\"CVE-2016-3696\", \"CVE-2016-3704\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for pulp FEDORA-2016-4373f7d32a\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'pulp'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"pulp on Fedora 24\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-4373f7d32a\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YM2LCC7QBRCK4LTN5EZT5OHTVAR3MYTY\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC24\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC24\")\n{\n\n if ((res = isrpmvuln(pkg:\"pulp\", rpm:\"pulp~2.8.6~1.fc24\", rls:\"FC24\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:34:57", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2016-08-18T00:00:00", "id": "OPENVAS:1361412562310809125", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310809125", "type": "openvas", "title": "Fedora Update for pulp-docker FEDORA-2016-4373f7d32a", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pulp-docker FEDORA-2016-4373f7d32a\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.809125\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-08-18 05:56:45 +0200 (Thu, 18 Aug 2016)\");\n script_cve_id(\"CVE-2016-3696\", \"CVE-2016-3704\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for pulp-docker FEDORA-2016-4373f7d32a\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'pulp-docker'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"pulp-docker on Fedora 24\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-4373f7d32a\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24ACJBITWVDOGKGNT2MJEYICFR72V53J\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC24\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC24\")\n{\n\n if ((res = isrpmvuln(pkg:\"pulp-docker\", rpm:\"pulp-docker~2.0.2~1.fc24\", rls:\"FC24\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:35:39", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2016-08-18T00:00:00", "id": "OPENVAS:1361412562310809132", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310809132", "type": "openvas", "title": "Fedora Update for pulp-ostree FEDORA-2016-4373f7d32a", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pulp-ostree FEDORA-2016-4373f7d32a\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.809132\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-08-18 05:56:40 +0200 (Thu, 18 Aug 2016)\");\n script_cve_id(\"CVE-2016-3696\", \"CVE-2016-3704\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for pulp-ostree FEDORA-2016-4373f7d32a\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'pulp-ostree'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"pulp-ostree on Fedora 24\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-4373f7d32a\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXXLFEJIXCALP6ZKY7MN5LQT2C2TFJIK\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC24\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC24\")\n{\n\n if ((res = isrpmvuln(pkg:\"pulp-ostree\", rpm:\"pulp-ostree~1.1.2~1.fc24\", rls:\"FC24\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:35:07", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2016-08-18T00:00:00", "id": "OPENVAS:1361412562310809124", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310809124", "type": "openvas", "title": "Fedora Update for pulp-python FEDORA-2016-4373f7d32a", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pulp-python FEDORA-2016-4373f7d32a\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.809124\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-08-18 05:56:36 +0200 (Thu, 18 Aug 2016)\");\n script_cve_id(\"CVE-2016-3696\", \"CVE-2016-3704\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for pulp-python FEDORA-2016-4373f7d32a\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'pulp-python'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"pulp-python on Fedora 24\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-4373f7d32a\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3M264FOAOH4OQRQ4CPO5CXNQFTILK6D\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC24\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC24\")\n{\n\n if ((res = isrpmvuln(pkg:\"pulp-python\", rpm:\"pulp-python~1.1.2~1.fc24\", rls:\"FC24\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "fedora": [{"lastseen": "2020-12-21T08:17:53", "description": "Provides a collection of platform plugins, client extensions and agent handlers that provide Puppet support ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-08-16T19:30:14", "type": "fedora", "title": "[SECURITY] Fedora 24 Update: pulp-puppet-2.8.6-2.fc24", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "modified": "2016-08-16T19:30:14", "id": "FEDORA:53D0B60427DD", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XVVYGGYGNEMADXS7A4ZIC5BUU5USDOKR/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:53", "description": "Provides a collection of Pulp server plugins and admin client extensions to support Docker content. ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-08-16T19:30:14", "type": "fedora", "title": "[SECURITY] Fedora 24 Update: pulp-docker-2.0.2-1.fc24", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "modified": "2016-08-16T19:30:14", "id": "FEDORA:2E63860427A5", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/24ACJBITWVDOGKGNT2MJEYICFR72V53J/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:53", "description": "Provides a collection of platform plugins and client extensions support for Python packages. ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-08-16T19:30:14", "type": "fedora", "title": "[SECURITY] Fedora 24 Update: pulp-python-1.1.2-1.fc24", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "modified": "2016-08-16T19:30:14", "id": "FEDORA:87A8B6087C4A", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/F3M264FOAOH4OQRQ4CPO5CXNQFTILK6D/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:53", "description": "Pulp provides replication, access, and accounting for software repositories. ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-08-16T19:30:14", "type": "fedora", "title": "[SECURITY] Fedora 24 Update: pulp-2.8.6-1.fc24", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "modified": "2016-08-16T19:30:14", "id": "FEDORA:65DE36087BBD", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/YM2LCC7QBRCK4LTN5EZT5OHTVAR3MYTY/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:53", "description": "Provides a collection of platform plugins and client extensions support for OSTree content. ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-08-16T19:30:14", "type": "fedora", "title": "[SECURITY] Fedora 24 Update: pulp-ostree-1.1.2-1.fc24", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "modified": "2016-08-16T19:30:14", "id": "FEDORA:230C060427A2", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VXXLFEJIXCALP6ZKY7MN5LQT2C2TFJIK/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:53", "description": "Provides a collection of platform plugins, client extensions and agent handlers that provide RPM support. ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-08-16T19:30:14", "type": "fedora", "title": "[SECURITY] Fedora 24 Update: pulp-rpm-2.8.6-2.fc24", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "modified": "2016-08-16T19:30:14", "id": "FEDORA:72BF86087C3B", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NLOCACI4V6UXTBG4ZYCTYJMLDFCY2Z4Y/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "nessus": [{"lastseen": "2023-01-26T14:20:50", "description": "2.8.6 is a security and bugfix release.\n\nIncluded in the list of fixed issues in 2.8.5 are two CVEs :\n\n - CVE-2016-3696: Leakage of CA key in pulp-qpid-ssl-cfg\n\n - CVE-2016-3704: Unsafe use of bash $RANDOM for NSS DB password and seed\n\nSeveral issues with database migrations are also addressed in this release.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2016-08-17T00:00:00", "type": "nessus", "title": "Fedora 24 : pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc (2016-4373f7d32a)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3696", "CVE-2016-3704"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:pulp", "p-cpe:/a:fedoraproject:fedora:pulp-docker", "p-cpe:/a:fedoraproject:fedora:pulp-ostree", "p-cpe:/a:fedoraproject:fedora:pulp-puppet", "p-cpe:/a:fedoraproject:fedora:pulp-python", "p-cpe:/a:fedoraproject:fedora:pulp-rpm", "cpe:/o:fedoraproject:fedora:24"], "id": "FEDORA_2016-4373F7D32A.NASL", "href": "https://www.tenable.com/plugins/nessus/92987", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2016-4373f7d32a.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92987);\n script_version(\"2.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-3696\", \"CVE-2016-3704\");\n script_xref(name:\"FEDORA\", value:\"2016-4373f7d32a\");\n\n script_name(english:\"Fedora 24 : pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc (2016-4373f7d32a)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"2.8.6 is a security and bugfix release.\n\nIncluded in the list of fixed issues in 2.8.5 are two CVEs :\n\n - CVE-2016-3696: Leakage of CA key in pulp-qpid-ssl-cfg\n\n - CVE-2016-3704: Unsafe use of bash $RANDOM for NSS DB\n password and seed\n\nSeveral issues with database migrations are also addressed in this\nrelease.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2016-4373f7d32a\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pulp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pulp-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pulp-ostree\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pulp-puppet\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pulp-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pulp-rpm\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:24\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/06/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/08/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^24([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 24\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC24\", reference:\"pulp-2.8.6-1.fc24\")) flag++;\nif (rpm_check(release:\"FC24\", reference:\"pulp-docker-2.0.2-1.fc24\")) flag++;\nif (rpm_check(release:\"FC24\", reference:\"pulp-ostree-1.1.2-1.fc24\")) flag++;\nif (rpm_check(release:\"FC24\", reference:\"pulp-puppet-2.8.6-2.fc24\")) flag++;\nif (rpm_check(release:\"FC24\", reference:\"pulp-python-1.1.2-1.fc24\")) flag++;\nif (rpm_check(release:\"FC24\", reference:\"pulp-rpm-2.8.6-2.fc24\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-01-11T14:39:49", "description": "An update is now available for Red Hat Satellite.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nRed Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.\n\nThis update provides Satellite 6.3 packages for Red Hat Enterprise Linux 7 Satellite server. For the full list of new features provided by Satellite 6.3, see the Release Notes linked to in the references section. See the Satellite 6 Installation Guide for detailed instructions on how to install a new Satellite 6.3 environment, or the Satellite 6 Upgrading and Updating guide for detailed instructions on how to upgrade from prior versions of Satellite 6.\n\nAll users who require Satellite version 6.3 are advised to install these new packages.\n\nSecurity Fix(es) :\n\n* V8: integer overflow leading to buffer overflow in Zone::New (CVE-2016-1669)\n\n* rubygem-will_paginate: XSS vulnerabilities (CVE-2013-6459)\n\n* foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to that Organization (CVE-2014-8183)\n\n* foreman: inspect in a provisioning template exposes sensitive controller information (CVE-2016-3693)\n\n* pulp: Unsafe use of bash $RANDOM for NSS DB password and seed (CVE-2016-3704)\n\n* foreman: privilege escalation through Organization and Locations API (CVE-2016-4451)\n\n* foreman: inside discovery-debug, the root password is displayed in plaintext (CVE-2016-4996)\n\n* foreman: Persistent XSS in Foreman remote execution plugin (CVE-2016-6319)\n\n* foreman: Stored XSS via organization/location with HTML in name (CVE-2016-8639)\n\n* katello-debug: Possible symlink attacks due to use of predictable file names (CVE-2016-9595)\n\n* rubygem-hammer_cli: no verification of API server's SSL certificate (CVE-2017-2667)\n\n* foreman: Image password leak (CVE-2017-2672)\n\n* pulp: Leakage of CA key in pulp-qpid-ssl-cfg (CVE-2016-3696)\n\n* foreman: Information disclosure in provisioning template previews (CVE-2016-4995)\n\n* foreman-debug: missing obfuscation of sensitive information (CVE-2016-9593)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Randy Barlow (RedHat) for reporting CVE-2016-3704 and Sander Bos for reporting CVE-2016-3696. The CVE-2014-8183 issue was discovered by Eric Helms (Red Hat); the CVE-2016-3693 and CVE-2016-4995 issues were discovered by Dominic Cleal (Red Hat); the CVE-2016-4451 and CVE-2016-6319 issues were discovered by Marek Hulan (Red Hat); the CVE-2016-4996 issue was discovered by Thom Carlin (Red Hat); the CVE-2016-8639 issue was discovered by Sanket Jagtap (Red Hat); the CVE-2016-9595 issue was discovered by Evgeni Golov (Red Hat); the CVE-2017-2667 issue was discovered by Tomas Strachota (Red Hat); and the CVE-2016-9593 issue was discovered by Pavel Moravec (Red Hat).", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-02-28T00:00:00", "type": "nessus", "title": "RHEL 7 : Satellite Server (RHSA-2018:0336)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-6459", "CVE-2014-8183", "CVE-2016-1669", "CVE-2016-3693", "CVE-2016-3696", "CVE-2016-3704", "CVE-2016-4451", "CVE-2016-4995", "CVE-2016-4996", "CVE-2016-6319", "CVE-2016-8639", "CVE-2016-9593", "CVE-2016-9595", "CVE-2017-15699", "CVE-2017-2295", "CVE-2017-2667", "CVE-2017-2672"], "modified": "2019-10-24T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:candlepin", "p-cpe:/a:redhat:enterprise_linux:candlepin-selinux", "p-cpe:/a:redhat:enterprise_linux:foreman", "p-cpe:/a:redhat:enterprise_linux:foreman-bootloaders-redhat", "p-cpe:/a:redhat:enterprise_linux:foreman-bootloaders-redhat-tftpboot", "p-cpe:/a:redhat:enterprise_linux:foreman-cli", "p-cpe:/a:redhat:enterprise_linux:foreman-compute", "p-cpe:/a:redhat:enterprise_linux:foreman-debug", "p-cpe:/a:redhat:enterprise_linux:foreman-discovery-image", "p-cpe:/a:redhat:enterprise_linux:foreman-ec2", "p-cpe:/a:redhat:enterprise_linux:foreman-gce", "p-cpe:/a:redhat:enterprise_linux:foreman-installer", "p-cpe:/a:redhat:enterprise_linux:foreman-installer-katello", "p-cpe:/a:redhat:enterprise_linux:foreman-libvirt", "p-cpe:/a:redhat:enterprise_linux:foreman-openstack", "p-cpe:/a:redhat:enterprise_linux:foreman-ovirt", "p-cpe:/a:redhat:enterprise_linux:foreman-postgresql", "p-cpe:/a:redhat:enterprise_linux:foreman-proxy", "p-cpe:/a:redhat:enterprise_linux:foreman-proxy-content", "p-cpe:/a:redhat:enterprise_linux:foreman-rackspace", "p-cpe:/a:redhat:enterprise_linux:foreman-selinux", "p-cpe:/a:redhat:enterprise_linux:foreman-vmware", "p-cpe:/a:redhat:enterprise_linux:hiera", "p-cpe:/a:redhat:enterprise_linux:katello", "p-cpe:/a:redhat:enterprise_linux:katello-certs-tools", "p-cpe:/a:redhat:enterprise_linux:katello-client-bootstrap", "p-cpe:/a:redhat:enterprise_linux:katello-common", "p-cpe:/a:redhat:enterprise_linux:katello-debug", "p-cpe:/a:redhat:enterprise_linux:katello-installer-base", "p-cpe:/a:redhat:enterprise_linux:katello-selinux", "p-cpe:/a:redhat:enterprise_linux:katello-service", "p-cpe:/a:redhat:enterprise_linux:kobo", "p-cpe:/a:redhat:enterprise_linux:pulp-admin-client", "p-cpe:/a:redhat:enterprise_linux:pulp-docker-admin-extensions", "p-cpe:/a:redhat:enterprise_linux:pulp-docker-plugins", "p-cpe:/a:redhat:enterprise_linux:pulp-katello", "p-cpe:/a:redhat:enterprise_linux:pulp-ostree-admin-extensions", "p-cpe:/a:redhat:enterprise_linux:pulp-ostree-plugins", "p-cpe:/a:redhat:enterprise_linux:pulp-puppet-admin-extensions", "p-cpe:/a:redhat:enterprise_linux:pulp-puppet-plugins", "p-cpe:/a:redhat:enterprise_linux:pulp-puppet-tools", "p-cpe:/a:redhat:enterprise_linux:pulp-rpm-admin-extensions", "p-cpe:/a:redhat:enterprise_linux:pulp-rpm-plugins", "p-cpe:/a:redhat:enterprise_linux:pulp-selinux", "p-cpe:/a:redhat:enterprise_linux:pulp-server", "p-cpe:/a:redhat:enterprise_linux:puppet-foreman_scap_client", "p-cpe:/a:redhat:enterprise_linux:python-pulp-bindings", "p-cpe:/a:redhat:enterprise_linux:python-pulp-client-lib", "p-cpe:/a:redhat:enterprise_linux:python-pulp-common", "p-cpe:/a:redhat:enterprise_linux:python-pulp-docker-common", "p-cpe:/a:redhat:enterprise_linux:python-pulp-oid_validation", "p-cpe:/a:redhat:enterprise_linux:python-pulp-ostree-common", "p-cpe:/a:redhat:enterprise_linux:python-pulp-puppet-common", "p-cpe:/a:redhat:enterprise_linux:python-pulp-repoauth", "p-cpe:/a:redhat:enterprise_linux:python-pulp-rpm-common", "p-cpe:/a:redhat:enterprise_linux:python-pulp-streamer", "p-cpe:/a:redhat:enterprise_linux:python-zope-interface", "p-cpe:/a:redhat:enterprise_linux:python-zope-interface-debuginfo", "p-cpe:/a:redhat:enterprise_linux:redhat-access-insights-puppet", "p-cpe:/a:redhat:enterprise_linux:rubygem-foreman_scap_client", "p-cpe:/a:redhat:enterprise_linux:rubygem-kafo", "p-cpe:/a:redhat:enterprise_linux:rubygem-kafo_parsers", "p-cpe:/a:redhat:enterprise_linux:rubygem-kafo_wizards", "p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_dhcp_remote_isc", "p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_discovery", "p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_discovery_image", "p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_dynflow", "p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_openscap", "p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_pulp", "p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_remote_execution_ssh", "p-cpe:/a:redhat:enterprise_linux:rubygem-tilt", "p-cpe:/a:redhat:enterprise_linux:satellite", "p-cpe:/a:redhat:enterprise_linux:satellite-capsule", "p-cpe:/a:redhat:enterprise_linux:satellite-cli", "p-cpe:/a:redhat:enterprise_linux:satellite-common", "p-cpe:/a:redhat:enterprise_linux:satellite-debug-tools", "p-cpe:/a:redhat:enterprise_linux:satellite-installer", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-bastion", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-redhat_access", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-tasks", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-tasks-core", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_bootdisk", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_discovery", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_docker", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_hooks", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_openscap", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_remote_execution", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_remote_execution_core", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_templates", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_theme_satellite", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_virt_who_configure", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_csv", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_admin", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_bootdisk", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_discovery", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_docker", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_openscap", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_remote_execution", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_tasks", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_virt_who_configure", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_katello", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-katello", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-katello_ostree", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ovirt_provision_plugin", "p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-smart_proxy_dynflow_core", "cpe:/o:redhat:enterprise_linux:7"], "id": "REDHAT-RHSA-2018-0336.NASL", "href": "https://www.tenable.com/plugins/nessus/107053", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2018:0336. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(107053);\n script_version(\"3.7\");\n script_cvs_date(\"Date: 2019/10/24 15:35:44\");\n\n script_cve_id(\"CVE-2013-6459\", \"CVE-2014-8183\", \"CVE-2016-1669\", \"CVE-2016-3693\", \"CVE-2016-3696\", \"CVE-2016-3704\", \"CVE-2016-4451\", \"CVE-2016-4995\", \"CVE-2016-4996\", \"CVE-2016-6319\", \"CVE-2016-8639\", \"CVE-2016-9593\", \"CVE-2016-9595\", \"CVE-2017-15699\", \"CVE-2017-2295\", \"CVE-2017-2667\", \"CVE-2017-2672\");\n script_xref(name:\"RHSA\", value:\"2018:0336\");\n\n script_name(english:\"RHEL 7 : Satellite Server (RHSA-2018:0336)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update is now available for Red Hat Satellite.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nRed Hat Satellite is a systems management tool for Linux-based\ninfrastructure. It allows for provisioning, remote management, and\nmonitoring of multiple Linux deployments with a single centralized\ntool.\n\nThis update provides Satellite 6.3 packages for Red Hat Enterprise\nLinux 7 Satellite server. For the full list of new features provided\nby Satellite 6.3, see the Release Notes linked to in the references\nsection. See the Satellite 6 Installation Guide for detailed\ninstructions on how to install a new Satellite 6.3 environment, or the\nSatellite 6 Upgrading and Updating guide for detailed instructions on\nhow to upgrade from prior versions of Satellite 6.\n\nAll users who require Satellite version 6.3 are advised to install\nthese new packages.\n\nSecurity Fix(es) :\n\n* V8: integer overflow leading to buffer overflow in Zone::New\n(CVE-2016-1669)\n\n* rubygem-will_paginate: XSS vulnerabilities (CVE-2013-6459)\n\n* foreman: models with a 'belongs_to' association to an Organization\ndo not verify association belongs to that Organization (CVE-2014-8183)\n\n* foreman: inspect in a provisioning template exposes sensitive\ncontroller information (CVE-2016-3693)\n\n* pulp: Unsafe use of bash $RANDOM for NSS DB password and seed\n(CVE-2016-3704)\n\n* foreman: privilege escalation through Organization and Locations API\n(CVE-2016-4451)\n\n* foreman: inside discovery-debug, the root password is displayed in\nplaintext (CVE-2016-4996)\n\n* foreman: Persistent XSS in Foreman remote execution plugin\n(CVE-2016-6319)\n\n* foreman: Stored XSS via organization/location with HTML in name\n(CVE-2016-8639)\n\n* katello-debug: Possible symlink attacks due to use of predictable\nfile names (CVE-2016-9595)\n\n* rubygem-hammer_cli: no verification of API server's SSL certificate\n(CVE-2017-2667)\n\n* foreman: Image password leak (CVE-2017-2672)\n\n* pulp: Leakage of CA key in pulp-qpid-ssl-cfg (CVE-2016-3696)\n\n* foreman: Information disclosure in provisioning template previews\n(CVE-2016-4995)\n\n* foreman-debug: missing obfuscation of sensitive information\n(CVE-2016-9593)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\n\nRed Hat would like to thank Randy Barlow (RedHat) for reporting\nCVE-2016-3704 and Sander Bos for reporting CVE-2016-3696. The\nCVE-2014-8183 issue was discovered by Eric Helms (Red Hat); the\nCVE-2016-3693 and CVE-2016-4995 issues were discovered by Dominic\nCleal (Red Hat); the CVE-2016-4451 and CVE-2016-6319 issues were\ndiscovered by Marek Hulan (Red Hat); the CVE-2016-4996 issue was\ndiscovered by Thom Carlin (Red Hat); the CVE-2016-8639 issue was\ndiscovered by Sanket Jagtap (Red Hat); the CVE-2016-9595 issue was\ndiscovered by Evgeni Golov (Red Hat); the CVE-2017-2667 issue was\ndiscovered by Tomas Strachota (Red Hat); and the CVE-2016-9593 issue\nwas discovered by Pavel Moravec (Red Hat).\"\n );\n # https://access.redhat.com/documentation/en-us/red_hat_satellite/6.3/html/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?1ae701e8\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2018:0336\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2013-6459\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-8183\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1669\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3696\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-3704\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-4451\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-4995\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-4996\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-6319\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-8639\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-9593\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-9595\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-2295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-2667\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-2672\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15699\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:candlepin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:candlepin-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-bootloaders-redhat\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-bootloaders-redhat-tftpboot\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-cli\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-compute\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-discovery-image\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-ec2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-gce\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-installer\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-installer-katello\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-libvirt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-openstack\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-ovirt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-postgresql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-proxy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-proxy-content\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-rackspace\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:foreman-vmware\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:hiera\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-certs-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-client-bootstrap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-installer-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-service\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kobo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-admin-client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-docker-admin-extensions\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-docker-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-katello\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-ostree-admin-extensions\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-ostree-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-puppet-admin-extensions\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-puppet-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-puppet-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-rpm-admin-extensions\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-rpm-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:pulp-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:puppet-foreman_scap_client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-bindings\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-client-lib\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-docker-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-oid_validation\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-ostree-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-puppet-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-repoauth\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-rpm-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-pulp-streamer\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-zope-interface\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-zope-interface-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:redhat-access-insights-puppet\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-foreman_scap_client\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-kafo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-kafo_parsers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-kafo_wizards\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_dhcp_remote_isc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_discovery\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_discovery_image\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_dynflow\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_openscap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_pulp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_remote_execution_ssh\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rubygem-tilt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:satellite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:satellite-capsule\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:satellite-cli\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:satellite-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:satellite-debug-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:satellite-installer\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-bastion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-redhat_access\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-tasks\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman-tasks-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_bootdisk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_discovery\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_hooks\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_openscap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_remote_execution\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_remote_execution_core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_templates\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_theme_satellite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-foreman_virt_who_configure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_csv\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_admin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_bootdisk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_discovery\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_openscap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_remote_execution\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_tasks\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_foreman_virt_who_configure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-hammer_cli_katello\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-katello\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-katello_ostree\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-ovirt_provision_plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:tfm-rubygem-smart_proxy_dynflow_core\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/12/31\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2018:0336\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL7\", rpm:\"spacewalk-admin-\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Satellite Server\");\n\n if (rpm_check(release:\"RHEL7\", reference:\"candlepin-2.1.14-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"candlepin-selinux-2.1.14-1.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-bootloaders-redhat-201801241201-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-bootloaders-redhat-tftpboot-201801241201-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-cli-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-compute-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-debug-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-discovery-image-3.4.4-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-ec2-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-gce-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-installer-1.15.6.8-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-installer-katello-3.4.5.26-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-libvirt-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-openstack-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-ovirt-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-postgresql-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-proxy-1.15.6.4-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-proxy-content-3.4.5-15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-rackspace-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-selinux-1.15.6.2-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"foreman-vmware-1.15.6.34-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"hiera-1.3.1-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"katello-3.4.5-15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"katello-certs-tools-2.4.0-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"katello-client-bootstrap-1.5.1-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"katello-common-3.4.5-15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"katello-debug-3.4.5-15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"katello-installer-base-3.4.5.26-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"katello-selinux-3.0.2-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"katello-service-3.4.5-15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"kobo-0.5.1-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-admin-client-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-docker-admin-extensions-2.4.1-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-docker-plugins-2.4.1-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-katello-1.0.2-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-ostree-admin-extensions-1.2.1.1-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-ostree-plugins-1.2.1.1-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-puppet-admin-extensions-2.13.4-3.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-puppet-plugins-2.13.4-3.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-puppet-tools-2.13.4-3.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-rpm-admin-extensions-2.13.4.8-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-rpm-plugins-2.13.4.8-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-selinux-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"pulp-server-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"puppet-foreman_scap_client-0.3.16-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-bindings-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-client-lib-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-common-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-docker-common-2.4.1-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-oid_validation-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-ostree-common-1.2.1.1-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-puppet-common-2.13.4-3.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-repoauth-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-rpm-common-2.13.4.8-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"python-pulp-streamer-2.13.4.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"python-zope-interface-4.0.5-4.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"python-zope-interface-debuginfo-4.0.5-4.el7\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"redhat-access-insights-puppet-0.0.9-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-foreman_scap_client-0.3.0-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-kafo-2.0.2-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-kafo_parsers-0.1.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-kafo_wizards-0.0.1-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-smart_proxy_dhcp_remote_isc-0.0.2.1-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-smart_proxy_discovery-1.0.4-3.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-smart_proxy_discovery_image-1.0.9-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-smart_proxy_dynflow-0.1.10-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-smart_proxy_openscap-0.6.9-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-smart_proxy_pulp-1.3.0-1.git.0.b5c2768.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-smart_proxy_remote_execution_ssh-0.1.6-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"rubygem-tilt-1.3.7-2.git.0.3b416c9.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"satellite-6.3.0-23.0.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"satellite-capsule-6.3.0-23.0.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"satellite-cli-6.3.0-23.0.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"satellite-common-6.3.0-23.0.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"satellite-debug-tools-6.3.0-23.0.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"satellite-installer-6.3.0.12-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-bastion-5.1.1.4-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman-redhat_access-2.0.13-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman-tasks-0.9.6.4-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman-tasks-core-0.1.8-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_bootdisk-10.0.2.2-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_discovery-9.1.5.3-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_docker-3.1.0.3-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_hooks-0.3.14-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_openscap-0.7.11-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_remote_execution-1.3.7.2-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_remote_execution_core-1.0.6-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_templates-5.0.1-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_theme_satellite-1.0.4.16-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-foreman_virt_who_configure-0.1.9-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli-0.11.0.1-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_csv-2.3.0-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman-0.11.0.5-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman_admin-0.0.8-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman_bootdisk-0.1.3.3-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman_discovery-1.0.0-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman_docker-0.0.6-2.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman_openscap-0.1.5-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman_remote_execution-0.0.6-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman_tasks-0.0.12-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_foreman_virt_who_configure-0.0.3-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-hammer_cli_katello-0.11.3.5-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-katello-3.4.5.58-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-katello_ostree-3.4.5.58-1.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-ovirt_provision_plugin-1.0.2-1.fm1_15.el7sat\")) flag++;\n if (rpm_check(release:\"RHEL7\", reference:\"tfm-rubygem-smart_proxy_dynflow_core-0.1.10-1.fm1_15.el7sat\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"candlepin / candlepin-selinux / foreman / etc\");\n }\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2023-02-02T17:29:10", "description": "It was found that the private CA key was created in a directory that is world-readable for a small amount of time. A local user could possibly use this flaw to gain access to the private key information in the file.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2017-06-13T16:29:00", "type": "cve", "title": "CVE-2016-3696", "cwe": ["CWE-200"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3696"], "modified": "2023-02-02T15:17:00", "cpe": ["cpe:/o:fedoraproject:fedora:24", "cpe:/a:pulpproject:pulp:2.8.4"], "id": "CVE-2016-3696", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3696", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:pulpproject:pulp:2.8.4:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*"]}, {"lastseen": "2023-02-02T23:31:32", "description": "Pulp makes unsafe use of Bash's $RANDOM to generate a NSS DB password and seed resulting in insufficient randomness. An attacker could potentially guess the seed used given enough time and compute resources.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2017-06-13T17:29:00", "type": "cve", "title": "CVE-2016-3704", "cwe": ["CWE-255"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-3704"], "modified": "2023-02-02T21:16:00", "cpe": ["cpe:/o:fedoraproject:fedora:24", "cpe:/a:pulpproject:pulp:2.8.4"], "id": "CVE-2016-3704", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3704", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:pulpproject:pulp:2.8.4:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*"]}], "redhat": [{"lastseen": "2022-08-16T17:44:47", "description": "Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.\n\nThis update provides Satellite 6.3 packages for Red Hat Enterprise Linux 7 Satellite server. For the full list of new features provided by Satellite 6.3, see the Release Notes linked to in the references section. See the Satellite 6 Installation Guide for detailed instructions on how to install a new Satellite 6.3 environment, or the Satellite 6 Upgrading and Updating guide for detailed instructions on how to upgrade from prior versions of Satellite 6.\n\nAll users who require Satellite version 6.3 are advised to install these new packages.\n\nSecurity Fix(es):\n\n* V8: integer overflow leading to buffer overflow in Zone::New (CVE-2016-1669)\n\n* rubygem-will_paginate: XSS vulnerabilities (CVE-2013-6459)\n\n* foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to that Organization (CVE-2014-8183)\n\n* foreman: inspect in a provisioning template exposes sensitive controller information (CVE-2016-3693)\n\n* pulp: Unsafe use of bash $RANDOM for NSS DB password and seed (CVE-2016-3704)\n\n* foreman: privilege escalation through Organization and Locations API (CVE-2016-4451)\n\n* foreman: inside discovery-debug, the root password is displayed in plaintext (CVE-2016-4996)\n\n* foreman: Persistent XSS in Foreman remote execution plugin (CVE-2016-6319)\n\n* foreman: Stored XSS via organization/location with HTML in name (CVE-2016-8639)\n\n* katello-debug: Possible symlink attacks due to use of predictable file names (CVE-2016-9595)\n\n* rubygem-hammer_cli: no verification of API server's SSL certificate (CVE-2017-2667)\n\n* foreman: Image password leak (CVE-2017-2672)\n\n* pulp: Leakage of CA key in pulp-qpid-ssl-cfg (CVE-2016-3696)\n\n* foreman: Information disclosure in provisioning template previews (CVE-2016-4995)\n\n* foreman-debug: missing obfuscation of sensitive information (CVE-2016-9593)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Randy Barlow (RedHat) for reporting CVE-2016-3704 and Sander Bos for reporting CVE-2016-3696. The CVE-2014-8183 issue was discovered by Eric Helms (Red Hat); the CVE-2016-3693 and CVE-2016-4995 issues were discovered by Dominic Cleal (Red Hat); the CVE-2016-4451 and CVE-2016-6319 issues were discovered by Marek Hul\u00e1n (Red Hat); the CVE-2016-4996 issue was discovered by Thom Carlin (Red Hat); the CVE-2016-8639 issue was discovered by Sanket Jagtap (Red Hat); the CVE-2016-9595 issue was discovered by Evgeni Golov (Red Hat); the CVE-2017-2667 issue was discovered by Tomas Strachota (Red Hat); and the CVE-2016-9593 issue was discovered by Pavel Moravec (Red Hat).", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-02-21T12:15:22", "type": "redhat", "title": "(RHSA-2018:0336) Important: Satellite 6.3 security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-6459", "CVE-2014-8183", "CVE-2016-1669", "CVE-2016-3693", "CVE-2016-3696", "CVE-2016-3704", "CVE-2016-4451", "CVE-2016-4995", "CVE-2016-4996", "CVE-2016-6319", "CVE-2016-7077", "CVE-2016-7078", "CVE-2016-8613", "CVE-2016-8634", "CVE-2016-8639", "CVE-2016-9593", "CVE-2016-9595", "CVE-2017-15699", "CVE-2017-2295", "CVE-2017-2667", "CVE-2017-2672", "CVE-2018-14623"], "modified": "2020-08-11T14:02:17", "id": "RHSA-2018:0336", "href": "https://access.redhat.com/errata/RHSA-2018:0336", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}]}