Authentication bypass in Red Hat Satellite

1) Improper Authentication

EUVDB-ID: #VU61248

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-4142

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can bypass authentication process by using the simple content access certificate for authentication with Candlepin.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.10.2

tfm-rubygem-katello (Red Hat package): 4.1.1.42-1.el7sat

satellite (Red Hat package): 6.10.2-1.el7sat

python-pulpcore (Red Hat package): 3.7.3-2.el7pc - 3.7.6-1.el7pc

tfm-rubygem-pulp_rpm_client (Red Hat package): 3.9.0-1.el7sat

tfm-rubygem-foreman_ansible (Red Hat package): 6.1.1-1.el7sat

python-pulp-rpm (Red Hat package): 3.9.0-1.el7pc

python-pulp-container (Red Hat package): 2.1.1-1.el7pc

tfm-rubygem-foreman_rh_cloud (Red Hat package): 1.0.4.1-2.el7sat

foreman (Red Hat package): 1.7.2.53-1.el7sat

python-aiohttp-xmlrpc (Red Hat package): before 1.3.2-0.1.el7pc

candlepin (Red Hat package): before 4.0.15-1.el7sat

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.10.2:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:tfm-rubygem-katello_redhat_package:4.1.1.42-1.el7sat:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:satellite_redhat_package:6.10.2-1.el7sat:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulpcore_redhat_package:3.7.3-2.el7pc:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulpcore_redhat_package:3.7.6-1.el7pc:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:tfm-rubygem-pulp_rpm_client_redhat_package:3.9.0-1.el7sat:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:tfm-rubygem-foreman_ansible_redhat_package:6.1.1-1.el7sat:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-rpm_redhat_package:3.9.0-1.el7pc:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-container_redhat_package:2.1.1-1.el7pc:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:tfm-rubygem-foreman_rh_cloud_redhat_package:1.0.4.1-2.el7sat:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman_redhat_package:1.7.2.53-1.el7sat:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-aiohttp-xmlrpc_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:candlepin_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2022:0790

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.