Bug 1247732 (CVE-2015-5164)

Summary:	CVE-2015-5164 Satellite6: python pickle() processing problem in pulp
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	POST ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, bmbouter, cpelland, dkliban, ggainey, gscarbor, ipanova, katello-bugs, mhrivnak, ohadlevy, pcreech, rchan, slong, ttereshc
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A flaw was found in the handling of Python pickle()-encoded messages in the Qpid server on Satellite 6. The Qpid server did not properly restrict message types that can be sent from managed content hosts. An attacker with administrative access to a managed content host could send arbitrary messages containing pickle()-encoded data, which would then be processed on the Satellite 6 server and result in possible code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1246263
Bug Blocks:

Description Kurt Seifried 2015-07-28 17:10:26 UTC

Brian Bouterse of Red Hat reports:

The Qpid server on Satellite6 does not properly restrict message types that can
be sent from managed content hosts. An attacker with administrative access to a
managed content host could send arbitrary messages containing pickle() encoded
data which would then be processed on the Satellite6 server.

Comment 1 pulp-infra@redhat.com 2015-09-11 16:30:58 UTC

The Pulp upstream bug status is at NEW. Updating the external tracker on this bug.

Comment 2 pulp-infra@redhat.com 2015-09-11 16:31:00 UTC

The Pulp upstream bug priority is at Normal. Updating the external tracker on this bug.

Comment 3 Kurt Seifried 2015-11-06 05:44:31 UTC

Acknowledgement:

This issue was discovered by Brian Bouterse of Red Hat.

Comment 5 pulp-infra@redhat.com 2015-12-09 15:31:40 UTC

The Pulp upstream bug status is at ASSIGNED. Updating the external tracker on this bug.

Comment 6 pulp-infra@redhat.com 2015-12-11 16:31:28 UTC

The Pulp upstream bug status is at MODIFIED. Updating the external tracker on this bug.

Comment 7 pulp-infra@redhat.com 2016-02-23 21:01:43 UTC

The Pulp upstream bug status is at ON_QA. Updating the external tracker on this bug.

Comment 8 pulp-infra@redhat.com 2016-03-23 18:32:14 UTC

The Pulp upstream bug status is at CLOSED - CURRENTRELEASE. Updating the external tracker on this bug.

Comment 9 pulp-infra@redhat.com 2016-11-21 21:04:22 UTC

All upstream Pulp bugs are at MODIFIED+. Moving this bug to POST.