Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
Security Bulletin
This security bulletin contains information about 12 vulnerabilities.
1) SQL injection
EUVDB-ID: #VU95445
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-42005
CWE-ID:
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in QuerySet.values() and values_list() functions. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU95444
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-41991
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in django.utils.html.urlize() and AdminURLFieldWidget. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Input validation error
EUVDB-ID: #VU95443
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-41990
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in django.utils.html.urlize() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Cryptographic issues
EUVDB-ID: #VU91833
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-33663
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform MitM attack.
The
vulnerability exists due to algorithm confusion with OpenSSH ECDSA keys and other key formats. A remote attacker can perform MitM attack.
Install updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Improper Handling of Case Sensitivity
EUVDB-ID: #VU89132
Risk: Medium
CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-32879
CWE-ID:
CWE-178 - Improper Handling of Case Sensitivity
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to default case-insensitive collation in MySQL or MariaDB databases. A remote user can bypass authentication process and gain unauthorized access to the application.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Resource exhaustion
EUVDB-ID: #VU95442
Risk: High
CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-41989
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in django.utils.numberformat.floatformat() function. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Input validation error
EUVDB-ID: #VU94188
Risk: Medium
CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2024-39614
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in django.utils.translation.get_supported_language_variant() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
8) Path traversal
EUVDB-ID: #VU94184
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-39330
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in django.core.files.storage.Storage.save() function. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Information disclosure
EUVDB-ID: #VU94183
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-39329
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the django.contrib.auth.backends.ModelBackend.authenticate() method. A remote attacker can enumerate users via a timing attack involving login requests for users with an unusable password.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Input validation error
EUVDB-ID: #VU94182
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-38875
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in django.utils.html.urlize() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Input validation error
EUVDB-ID: #VU96644
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-7246
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to insufficient validation of HTTP/2 headers. A remote attacker can send a series of HTTP/2 requests to the application and gain access to sensitive information or perform spoofing attack.
Install updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Infinite loop
EUVDB-ID: #VU94792
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-5569
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop. A remote attacker can pass a specially crafted zip file to the application, consume all available system resources and cause denial of service conditions.
MitigationInstall updates from vendor's website.
python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap
python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap
python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap
python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap
python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap
python3x-django (Red Hat package): before 4.2.15-1.el8ap
python-zipp (Red Hat package): before 3.19.2-1.el9ap
python-pulpcore (Red Hat package): before 3.28.31-1.el9ap
python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap
python-jmespath (Red Hat package): before 0.10.0-5.el9ap
python-gunicorn (Red Hat package): before 22.0.0-2.el9ap
python-grpcio (Red Hat package): before 1.58.3-1.el9ap
python-django (Red Hat package): before 4.2.15-1.el9ap
automation-controller (Red Hat package): before 4.5.10-1.el9ap
Ansible Automation Platform: before 2.4
External linkshttp://access.redhat.com/errata/RHSA-2024:6428
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
