SB2024042346 - Multiple vulnerabilities in Red Hat Satellite 6.15
Published: April 23, 2024 Updated: November 29, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 18 secuirty vulnerabilities.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-47627)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when AIOHTTP_NO_EXTENSIONS is enabled. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2024-23829)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
3) Path traversal (CVE-ID: CVE-2024-23334)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in aiohttp.web.static(follow_symlinks=True). A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Request examples:
For windows: /static/../D:\flag.txt Poc
For Linux: /static/../../../../etc/passwd
4) Cross-site scripting (CVE-ID: CVE-2024-22195)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the xmlattr filter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Race condition (CVE-ID: CVE-2024-22047)
The vulnerability allows a remote user to alter application logs.
The vulnerability exists due to a race condition. A remote user can cause audit log entries to be attributed to another user.
6) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2024-21647)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when parsing chunked transfer encoding bodies. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
7) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-49082)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when processing HTTP request method. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
8) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-49081)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when processing HTTP version. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
9) Resource exhaustion (CVE-ID: CVE-2023-43665)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the chars() and words() methods. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
10) Inefficient regular expression complexity (CVE-ID: CVE-2022-40896)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions in pygments/lexers/smithy.py. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
11) Resource exhaustion (CVE-ID: CVE-2023-41164)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the django.utils.encoding.uri_to_iri() method. A remote attacker can pass a large number of characters to the affected method and perform a denial of service (DoS) attack.
12) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-40167)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when handling the "+" character passed via the HTTP/1 header field. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
13) Cleartext storage of sensitive information (CVE-ID: CVE-2023-38037)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software uses a temporary file for storing unencrypted files. A local user can gain access to sensitive information.
14) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-37276)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests in the aiohttp.web.Application. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
15) Input validation error (CVE-ID: CVE-2023-36479)
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in org.eclipse.jetty.servlets.CGI Servlet when quoting a command before its execution. A remote user can force the application to execute arbitrary file on the server and potentially compromise the system.
16) Path traversal (CVE-ID: CVE-2023-5189)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in symbolic link filename within the _extract_archive() function in galaxy-importer/collection.py. A remote attacker can trick the victim to use a specially crafted archive and overwrite arbitrary files on the system.
17) Improper Authorization (CVE-ID: CVE-2023-4320)
The vulnerability allows a remote user to gain unauthorized access to the application.
The vulnerability exists due to an arithmetic overflow when creating a new personal access token. A remote user can create personal access tokens that are valid indefinitely.
18) Observable discrepancy (CVE-ID: CVE-2023-52323)
The vulnerability allows a remote attacker to perform a side-channel attack.
The vulnerability exists due to observable discrepancy, which allows the side-channel leakage for OAEP decryption. A remote attacker can perform a Manger attack and gain access to sensitive information.
Remediation
Install update from vendor's website.