Critical: Red Hat Security Advisory: spacewalk-java security update

Updated spacewalk-java packages that fix one security issue are now available for Red Hat Satellite 5.3, 5.4, 5.5 and 5.6. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

RHEL 5 / 6 : spacewalk-backend (RHSA-2012:0101)

Updated spacewalk-backend packages that fix one security issue and two bugs are now available for Red Hat Network Satellite 5.4. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

RHEL 5 / 6 : Red Hat Network Proxy spacewalk-backend (RHSA-2012:0102)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0102 advisory. Red Hat Network RHN Proxy provides a mechanism for caching content, such as package updates from Red Hat or custom content created for an...

Design/Logic Flaw

The SUSE Audit Log Keeper daemon before 0.2.1-0.4.6.1 for SUSE Manager and Spacewalk uses world-readable permissions for /etc/auditlog-keeper.conf, which allows local users to obtain passwords by reading this file...

CVE-2012-0421

The CVE affects the SUSE Audit Log Keeper daemon used with SUSE Manager and Spacewalk. It arises from world-readable permissions on /etc/auditlog-keeper.conf, allowing local users to read passwords stored there, as described for versions before 0.2.1-0.4.6.1. Impact is local confidentiality leaka...

CVE-2012-0421: Exposure of Sensitive Information to an Unauthorized Actor

The SUSE Audit Log Keeper daemon before 0.2.1-0.4.6.1 for SUSE Manager and Spacewalk uses world-readable permissions for /etc/auditlog-keeper.conf, which allows local users to obtain passwords by reading this file...

Design/Logic Flaw

spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when modwsgi is used, which allows remote attackers to cause a denial of service /var partition disk consumption and failed updates via a...

CVE-2012-1145

spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when modwsgi is used, which allows remote attackers to cause a denial of service /var partition disk consumption and failed updates via a...

CVE-2012-1145: Improper Authentication

spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when modwsgi is used, which allows remote attackers to cause a denial of service /var partition disk consumption and failed updates via a...

CVE-2012-1145

Summary (supported by connected documents): CVE-2012-1145 affects Red Hat Network Satellite’s spacewalk-backend on Red Hat Enterprise Linux 6. A remote attacker could upload packages to the NULL organization (via mod_wsgi) without proper authorization/authentication, leading to disk-space exhaust...

Moderate: Red Hat Security Advisory: Red Hat Network Satellite spacewalk-backend security update

Updated spacewalk-backend packages that fix one security issue are now available for Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, whi...

Spacewalk: RHN user password disclosure upon failed system registration

Spacewalk-backend in Red Hat Network RHN Satellite and Proxy 5.4 includes cleartext user passwords in an error message when a system registration XML-RPC call fails, which allows remote administrators to obtain the password by reading 1 the server log and 2 an email...

Spacewalk: RHN user password disclosure upon failed system registration

Spacewalk-backend in Red Hat Network RHN Satellite and Proxy 5.4 includes cleartext user passwords in an error message when a system registration XML-RPC call fails, which allows remote administrators to obtain the password by reading 1 the server log and 2 an email...

Spacewalk: login page open redirect via url_bounce

Open redirect vulnerability in Spacewalk 1.6, as used in Red Hat Network RHN Satellite, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the urlbounce parameter...

Satellite/Spacewalk: XSS on the Lost Password page

Cross-site scripting XSS vulnerability in the Lookup Login/Password form in Spacewalk 1.6, as used in Red Hat Network RHN Satellite, allows remote attackers to inject arbitrary web script or HTML via the URI...

Satellite/Spacewalk: XSS flaw in channels search

Multiple cross-site scripting XSS vulnerabilities in Spacewalk 1.6, as used in Red Hat Network RHN Satellite, allow remote attackers to inject arbitrary web script or HTML via vectors related to Search forms...

Satellite: XSS flaw(s) in filter handling

Multiple cross-site scripting XSS vulnerabilities in Spacewalk 1.6, as used in Red Hat Network RHN Satellite, allow remote attackers to inject arbitrary web script or HTML via the "Filter by Synopsis" field and other unspecified filter forms...

Spacewalk: XSS on SystemGroupList.do page

Cross-site scripting XSS vulnerability in Spacewalk 1.6, as used in Red Hat Network RHN Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page...

CVE-2009-4139

A flaw was found in Spacewalk Java site packages. This cross-site request forgery CSRF vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileg...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Spacewalk Java site packages aka spacewalk-java 1.2.39 in Spacewalk, as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests...