Bug 1540343 (CVE-2017-15136)
Summary: | CVE-2017-15136 katello: system registration hostname hijacking results in inability to access updates | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Kurt Seifried <kseifried> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED WONTFIX | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | bcourt, bkearney, jhutar, jmatthew, mmccune, ohadlevy, rchan, security-response-team, tsanders |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: |
When registering a system with Satellite 6 a hostname must be specified. if an additional system is registered with the same hostname, the original system will stop receiving updates from Satellite 6. An attacker with administrative privileges to add systems to a Satellite 6 server could exploit this to prevent other hosts from getting security updates.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2020-08-06 13:27:46 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1501197, 1540345, 1540346 | ||
Bug Blocks: | 1516191 |
Description
Kurt Seifried
2018-01-30 19:55:33 UTC
Acknowledgments: Name: Jan Hutař (Red Hat) This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2017-15136 |