Bug 1187339 (CVE-2014-8162)

Summary:	CVE-2014-8162 Satellite5: RPC API XML External Entities file disclosure
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, cpelland, cperry, ggainey, jhutar, jrusnack, kseifried, meissner, mkollar, mmccune, security-response-team, syangsao, taw, thomas, tjay, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that the RPC interface in Satellite would resolve external entities, allowing an attacker to conduct XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the Satellite server, and potentially perform other more advanced XXE attacks.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-05-11 19:06:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1181470, 1215814
Bug Blocks:	1187346

Description Kurt Seifried 2015-01-29 19:28:53 UTC

Travis Emmert reports:

The RPC interface that exists on the satellite server at http(s)://hostname/rpc/api is vulnerable to a XML external entities attack. The XML parser that handles the body of the RPC request is insecurely configured, allowing for a wide range of attacks.

Comment 19 Kurt Seifried 2015-05-11 16:12:43 UTC

Acknowledgement:

Red Hat would like to thank Travis Emmert for reporting this issue.

Comment 20 errata-xmlrpc 2015-05-11 17:40:51 UTC

This issue has been addressed in the following products:

  Red Hat Satellite Server v 5.7

Via RHSA-2015:0957 https://rhn.redhat.com/errata/RHSA-2015-0957.html