Bug 1593803 (CVE-2018-10870)
| Summary: | CVE-2018-10870 redhat-certification: rhcertStore.py:__saveResultsFile allows to write any file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Riccardo Schirone <rschiron> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | abehl, brose, gnichols, mdshaikh, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | redhat-certification 5.15-20180717 | Doc Type: | If docs needed, set a value |
| Doc Text: |
It has been discovered that redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-08-10 06:12:04 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1608782 | ||
| Bug Blocks: | 1593614 | ||
|
Description
Riccardo Schirone
2018-06-21 15:30:19 UTC
Acknowledgments: Name: Riccardo Schirone (Red Hat Product Security) Mitigation: If SELinux is enabled it further restricts the set of files an attacker may write to. This prevents some basic attacks that would allow to gain remote code execution, though it is not excluded other means are possible. resultsFileName in rhcertStore.py:__saveResultsFile creates the path on the server by concatenating some fixed strings with others that can be manipulated by an attacker. In particular, when uploading a "transfer" file in /save, the clientIP is used to construct the final path, however clientIP is under the attacker's control because taken from the X-Forwarded-For HTTP header. This issue has been addressed in the following products: Red Hat Certification for Red Hat Enterprise Linux 7 Via RHSA-2018:2373 https://access.redhat.com/errata/RHSA-2018:2373 |