Advisory ROSA-SA-2024-2436

software: cfengine 3.21.3 OS: ROSA-CHROME packageevrstring: cfengine-3.21.3-1 CVE-ID: CVE-2021-36756 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: There is no SSL certificate validation in CFEngine Enterprise. CVE-STATUS: Fixed CVE-REV: To close, execute command: sudo dnf update cfengine CVE-ID:...

OPENSUSE-SU-2024:11873-1 cfengine-3.19.0-1.1 on GA media

These are all security issues fixed in the cfengine-3.19.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

UBUNTU-CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

Northern.tech CFEngine Security Breach

Northern.tech CFEngine is an IT infrastructure configuration management and automation framework. A security vulnerability exists in Northern.tech CFEngine Enterprise versions 3.6.0 through 3.18.6 and prior to 3.21.3, which stems from an injection flaw in the Web UI, Mission Portal, and results i...

PT-2023-29650

Name of the Vulnerable Software and Affected Versions CFEngine Enterprise versions 3.6.0 through 3.18.5 CFEngine Enterprise versions 3.21.0 through 3.21.2 Description The issue is a SQL Injection vulnerability in the Mission Portal login page of the CFEngine hub. This vulnerability allows for SQL...

CVE-2023-45684: Improper Neutralization of Special Elements used in an SQL Command

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub...

CVE-2023-45684

The CVE-2023-45684 issue affects Northern.tech CFEngine Enterprise, specifically the Mission Portal login page. A SQL Injection vulnerability exists in CFEngine Hub’s Mission Portal, with earliest affected version 3.6.0 and a broad range up to 3.18.5 (for the 3.6.0–3.18.5 line) and 3.21.0–3.21.2 ...

SUSE SLES12 Security Update : cfengine, cfengine-masterfiles (SUSE-SU-2023:2126-1)

"The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2126-1 advisory. Changes in cfengine: - cfengine3.target: removed, replaced by upstream cfengine3.service - In version 3.15.0, cfengine core split...

SUSE-SU-2023:2126-1 Security update for cfengine, cfengine-masterfiles

This update for cfengine, cfengine-masterfiles fixes the following issues: Changes in cfengine: - cfengine3.target: removed, replaced by upstream cfengine3.service - In version 3.15.0, cfengine core split off libutils and libcompat directories as libntech. We include both together as we do not us...

CVE-2023-26560

Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials...

Design/Logic Flaw

Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials...

CVE-2023-26560

Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials...