Bug 2140577 (CVE-2022-3874) - CVE-2022-3874 foreman: OS command injection via ct_command and fcct_command
Summary: CVE-2022-3874 foreman: OS command injection via ct_command and fcct_command
Keywords:
Status: NEW
Alias: CVE-2022-3874
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
: 2162972 (view as bug list)
Depends On: 2144846 2163694 2163695 2141267 2144841
Blocks: 2139519 2162363
TreeView+ depends on / blocked
 
Reported: 2022-11-07 10:02 UTC by ybuenos
Modified: 2023-07-07 08:34 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description ybuenos 2022-11-07 10:02:17 UTC 
In the Foreman component of Satellite, the ct_command and fcct_command settings allow authenticated users to execute arbitrary commands on the server. These commands are used to transpile CoreOS and Fedora CoreOS configurations in templates. Changing the command requires admin privileges on the Foreman instance.
Comment 3 ybuenos 2023-01-24 09:41:49 UTC 
*** Bug 2162972 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.