Bug 1873926 (CVE-2020-14380)
| Summary: | CVE-2020-14380 Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Yadnyawalk Tale <ytale> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | bbuckingham, bcourt, bkearney, btotty, hhudgeon, lzap, mmccune, mvanderw, nmoumoul, rchan, rjerrido, sokeeffe, wclark |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
Red Hat Satellite's external authentication component is vulnerable to a full account takeover flaw. This flaw allows an attacker with an authenticated account on Single sign-on (SSO) to gain elevated privileges of existing local users. This issue only affects users who have configured Satellite to use Apache SSO or Open ID Connect external authentication sources, and that have not disabled the auto-creation of users on login. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-10-27 14:21:55 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1873439, 1873933 | ||
| Bug Blocks: | 1873914 | ||
|
Description
Yadnyawalk Tale
2020-08-31 03:57:56 UTC
Acknowledgments: Name: Stefan Meyer (Red Hat) Mitigation: This issue can be mitigated by disabling the external login if a Satellite user has their authentication set to INTERNAL. Hotfixes for this issue are available for Satellite 6.7.2 and Satellite 6.7.3 To obtain the Hotfix for your Satellite version, please open a support case with Red Hat Technical Support, as the Hotfix RPM is too large to be provided as a bugzilla attachment INSTALLATION INSTRUCTIONS: (Both versions) 1. Make a backup or snapshot or Satellite server (Both versions) 2. Obtain the Hotfix RPM from Red Hat Technical Support and copy it to Satellite server (Satellite 6.7.2) 3. # rpm -Uvh --nodeps foreman-1.24.1.24-3.HOTFIXRHBZ1798489RHBZ1792135RHBZ1873439.el7sat.noarch.rpm (Satellite 6.7.3) 3. # rpm -Uvh --nodeps foreman-1.24.1.25-2.HOTFIXRHBZ1798489RHBZ1792135RHBZ1873439.el7sat.noarch.rpm (Both versions) 4. # satellite-maintain service restart This issue has been addressed in the following products: Red Hat Satellite 6.7 for RHEL 8 Via RHSA-2020:4366 https://access.redhat.com/errata/RHSA-2020:4366 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-14380 |