Bug 2077980 - SCT/SCTPro: Forged Remote Requests
Summary: SCT/SCTPro: Forged Remote Requests
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2077978
TreeView+ depends on / blocked
 
Reported: 2022-04-22 18:57 UTC by Sage McTaggart
Modified: 2023-01-09 04:20 UTC (History)
1 user (show)

Fixed In Version: SCT v 14.2.2
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability in all versions of SCT/SCT Pro prior to version 14.2.2 allows a remote unauthenticated attacker to identify and forge requests to internal systems via a specially crafted request, resulting in a loss of confidentiality.
Clone Of:
Environment:
Last Closed: 2022-04-25 07:21:59 UTC
Embargoed:

Attachments (Terms of Use)

Description Sage McTaggart 2022-04-22 18:57:24 UTC 
A vulnerability in all versions of SCT/SCT Pro prior to version 14.2.2 allows a remote unauthenticated attacker to identify and forge requests to internal systems via a specially crafted request allowing the attacker to determine if specific files or paths exist. This issue affects all versions of SCT/SCT Pro prior to version 14.2.2.

https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Comment 1 Kevin Kofler 2022-04-22 20:11:59 UTC 
Why the heck did you add all those CCs? I do not see how this vulnerability would affect me or any of my packages.
Comment 2 Vitaly 2022-04-23 11:25:02 UTC 
Why did you add me to this issue? I'm not maintainer of SCT package.
Comment 3 Marian Rehak 2022-04-25 07:08:43 UTC 
Apologies, I am working on correcting this. An issue with tooling arose.
Comment 4 Marian Rehak 2022-04-25 07:21:59 UTC 
This is a result of a tooling mishap. All products listed here are considered NOTAFFECTED.
Note You need to log in before you can comment on or make changes to this bug.