Bug 2077980

Summary:	SCT/SCTPro: Forged Remote Requests
Product:	[Other] Security Response	Reporter:	Sage McTaggart <amctagga>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mrehak
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	SCT v 14.2.2	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability in all versions of SCT/SCT Pro prior to version 14.2.2 allows a remote unauthenticated attacker to identify and forge requests to internal systems via a specially crafted request, resulting in a loss of confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-04-25 07:21:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2077978

Description Sage McTaggart 2022-04-22 18:57:24 UTC

A vulnerability in all versions of SCT/SCT Pro prior to version 14.2.2 allows a remote unauthenticated attacker to identify and forge requests to internal systems via a specially crafted request allowing the attacker to determine if specific files or paths exist. This issue affects all versions of SCT/SCT Pro prior to version 14.2.2.

https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02
https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Comment 1 Kevin Kofler 2022-04-22 20:11:59 UTC

Why the heck did you add all those CCs? I do not see how this vulnerability would affect me or any of my packages.

Comment 2 Vitaly 2022-04-23 11:25:02 UTC

Why did you add me to this issue? I'm not maintainer of SCT package.

Comment 3 Marian Rehak 2022-04-25 07:08:43 UTC

Apologies, I am working on correcting this. An issue with tooling arose.

Comment 4 Marian Rehak 2022-04-25 07:21:59 UTC

This is a result of a tooling mishap. All products listed here are considered NOTAFFECTED.