Bug 1593631 – CVE-2018-10865 redhat-certification: "restart" a node without authorization

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1593631 - (CVE-2018-10865) CVE-2018-10865 redhat-certification: "restart" a node without authorization

Summary:	CVE-2018-10865 redhat-certification: "restart" a node without authorization

Status:	NEW

Aliases:	CVE-2018-10865

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180621,reported=2...
Keywords:	Security

Depends On:	1608910
Blocks:	1593614
	Show dependency tree / graph

Reported:	2018-06-21 05:24 EDT by Riccardo Schirone
Modified:	2018-07-26 09:41 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	It has been discovered that redhat-certification does not perform an authorization check and allows an unauthenticated user to call a "restart" RPC method on any host accessible by the system. An attacker could use this flaw to send requests to port 8009 of any host or to keep restarting the RHCertD daemon on a host of another customer.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Riccardo Schirone 2018-06-21 05:24:28 EDT

It has been discovered that the /configuration view of redhat-certification does
not perform an authorization check and it allows an unauthenticated user to call
a "restart" RPC method on any host accessible by the system, even if not
belonging to him.

Comment 1 Riccardo Schirone 2018-06-21 05:24:37 EDT

Acknowledgments:

Name: Riccardo Schirone (Red Hat Product Security)

Note You need to log in before you can comment on or make changes to this bug.