Bug 2305718 (CVE-2024-7923)

Summary: CVE-2024-7923 puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore
Product: [Other] Security Response Reporter: Avinash Hanwate <ahanwate>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: anthomas, bbuckingham, brking, darunesh, dranck, ehelms, ggainey, gtanzill, haoli, hkataria, jcammara, jmitchel, jneedle, jtanner, juwatts, kshier, lbrazdil, mabashia, mhulan, mminar, nmoumoul, osousa, pbraun, pcreech, rbiba, rchan, security-response-team, simaishi, smallamp, smcdonal, sskracic, stcannon, teagle, tfister, thavo, tpfromme, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2024-09-04   

Description Avinash Hanwate 2024-08-19 12:40:08 UTC 
An authentication bypass vulnerability has been identified in Foreman when deployed with Gunicorn versions prior to 22.0, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 4.0+ and could potentially enable unauthorized users to gain administrative access.
Comment 1 errata-xmlrpc 2024-09-04 14:45:29 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.15 for RHEL 8

Via RHSA-2024:6335 https://access.redhat.com/errata/RHSA-2024:6335
Comment 2 errata-xmlrpc 2024-09-04 14:48:21 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.13 for RHEL 8

Via RHSA-2024:6337 https://access.redhat.com/errata/RHSA-2024:6337
Comment 3 errata-xmlrpc 2024-09-04 14:48:27 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.14 for RHEL 8

Via RHSA-2024:6336 https://access.redhat.com/errata/RHSA-2024:6336
Comment 4 errata-xmlrpc 2024-11-05 17:25:08 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2024:8906 https://access.redhat.com/errata/RHSA-2024:8906