Bug 1385777 (CVE-2016-7077)

Summary: CVE-2016-7077 foreman: Foreman information leak through unauthorized multiple_checkboxes helper
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: apevec, ayoung, bkearney, cbillett, ceph-eng-bugs, chrisw, cvsbot-xmlrpc, jjoyce, jmatthew, jschluet, kbasil, lhh, lpeer, markmc, mburns, mmccune, ohadlevy, rbryant, rhos-maint, satellite6-bugs, sclewis, sisharma, srevivo, tdecacqu, tlestach, tsanders
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20161017,reported=20161017,source=upstream,cvss2=3.5/AV:N/AC:M/Au:S/C:P/I:N/A:N,cvss3=4.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,cwe=CWE-285,rhn_satellite_6/foreman=affected,openstack-foreman/foreman=wontfix,openstack-6-installer/foreman=wontfix,ceph-1.3/foreman=wontfix
Fixed In Version: foreman 1.14.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1391131, 1391140, 1399324    
Bug Blocks: 1385778, 1432306    

Description Adam Mariš 2016-10-17 16:34:11 UTC
Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.

Affects Foreman since at least version 1.8.

Upstream bug:

http://projects.theforeman.org/issues/16971

Comment 1 Adam Mariš 2016-10-17 16:34:35 UTC
Acknowledgments:

Name: the Foreman project
Upstream: Jitendra Yejare