Bug 2256891 (CVE-2024-22047)

Summary:	CVE-2024-22047 audited: race condition can lead to audit logs being incorrectly attributed to the wrong user
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bbuckingham, bcourt, ehelms, jsherril, lzap, mhulan, nmoumoul, orabin, pcreech, rchan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	audited 5.3.3	Doc Type:	---
Doc Text:	A race condition flaw was found in Audited. This issue may allow an authenticated user to attribute audit log entries to another user.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2258593
Bug Blocks:	2256889

Description Robb Gatica 2024-01-05 01:37:41 UTC

Description:
In certain setups with threaded web servers, Audited's use of Thread.current can incorrectly attributed audits to the wrong user.

Patches:
Fixed in 5.3.3.

In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions.

The first issue we identified was from November 2021: collectiveidea/audited#601
So the solution was implemented in the following Pull Request: collectiveidea/audited#669
And the feature was published in version 5.3.3: RELEASE: collectiveidea/audited#671

References:
https://github.com/advisories/GHSA-hjp3-5g2q-7jww 	
https://github.com/collectiveidea/audited/issues/601 	
https://github.com/collectiveidea/audited/pull/669 	
https://github.com/collectiveidea/audited/pull/671 	
https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww 	
https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww

Comment 6 errata-xmlrpc 2024-04-23 17:16:56 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.15 for RHEL 8

Via RHSA-2024:2010 https://access.redhat.com/errata/RHSA-2024:2010