RHEL 6 : spacewalk-backend and spacewalk-proxy (RHSA-2019:1663)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1663 advisory. Spacewalk is an Open Source systems management solution that provides system provisioning, configuration and patching capabilities. Security Fixes:...

CVE-2019-10137

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitra...

CVE-2019-10137

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitra...

CVE-2019-10136

It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum...

CVE-2019-10136

It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum...

Design/Logic Flaw

It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum...

CVE-2019-10136

It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum...

CVE-2019-10136

CVE-2019-10136 is a Spacewalk vulnerability. The issue arises from Spacewalk (versions up to 2.9) not safely computing client token checksums, allowing an attacker with a valid but expired authenticated header set to rearrange digits and extend session validity without changing the checksum. Publ...

CVE-2019-10137

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitra...

CVE-2019-10137

CVE-2019-10137 : A path traversal flaw in spacewalk-proxy (versions up to 2.9) stems from how the proxy processes cached client tokens, allowing a remote, unauthenticated attacker to test for arbitrary files on the proxy filesystem or execute code in the httpd context. Affected: spacewalk-proxy. ...

spacewalk: Insecure computation of authentication signatures during user authentication

It was found that Spacewalk did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum...

Low: Red Hat Security Advisory: spacewalk-backend security update

An update for spacewalk-backend is now available for Red Hat Satellite 5.8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: Red Hat Security Advisory: spacewalk-backend and spacewalk-proxy security update

An update for spacewalk-backend and spacewalk-proxy is now available for Red Hat Satellite Proxy v 5.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

spacewalk-proxy: Path traversal in proxy authentication cache

A path traversal flaw was found in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process...

CVE-2019-10136: Improper Verification of Cryptographic Signature

It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum...

CVE-2019-10137: Improper Limitation of a Pathname to a Restricted Directory

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitra...

PT-2019-11592 · Red Hat +1 · Spacewalk +1

Name of the Vulnerable Software and Affected Versions: Spacewalk versions prior to 2.10 Description: The issue arises from the unsafe computation of client token checksums. An attacker with a valid but expired authenticated set of headers could manipulate the session validity without altering the...

spacewalk spacewalk-proxy path traversal vulnerability

spacewalk is an open source Linux system management solution. spacewalk-proxy is one of the proxy programs. A path traversal vulnerability in spacewalk spacewalk-proxy version 2.9, which arises from a failure of a networked system or product to properly filter special elements in the path of a...

SUSE-SU-2019:1703-1 Security update for SUSE Manager Server 3.2

This update fixes the following issues: cobbler: - Removes string replace for textmode fix bsc1134195 py26-compat-salt: - Avoid syntax error on yumpkg module running on Python 2.6 bsc1136250 - Use ThreadPool from multiprocessing.pool to avoid leakins when calculating FQDNs - Fix usermod options f...

SUSE-RU-2019:1703-1 Security update for SUSE Manager Server 3.2

This update fixes the following issues: cobbler: - Removes string replace for textmode fix bsc1134195 py26-compat-salt: - Avoid syntax error on yumpkg module running on Python 2.6 bsc1136250 - Use ThreadPool from multiprocessing.pool to avoid leakins when calculating FQDNs - Fix usermod options f...