Bug 2064616 (CVE-2022-24721)

Summary:	CVE-2022-24721 cometd: Improper Authorization in org.cometd.oort
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, avibelli, bgeorges, bibryam, chazlett, clement.escoffier, dandread, dkreling, drieden, ggaughan, gmalinko, gsmet, hamadhan, hbraun, janstey, jnethert, jochrist, jschatte, jwon, krathod, lthon, mszynkie, pantinor, pdelbell, peholase, pgallagh, pjindal, probinso, rareddy, rruss, rsvoboda, sbiarozk, sdouglas
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cometd 5.0.11, cometd 6.0.6, cometd 7.0.6	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in CometD’s Oort package. This flaw allows an attacker to monitor unauthorized channels when connected remotely.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-04-04 20:23:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2064617

Description Avinash Hanwate 2022-03-16 09:42:44 UTC

CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other users' (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure. A fix is available in versions 5.0.11, 6.0.6, and 7.0.6. As a workaround, install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.

https://github.com/cometd/cometd/issues/1146
https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv

Comment 2 Product Security DevOps Team 2022-04-04 20:23:53 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-24721