[oss-security] CVE-2024-7012, CVE-2024-7923: Authentication bypass in Foreman & Pulpcore

[Christian Hoffmann]

Hi,




From [2]:
> #### CVE-2024-7923: Authentication bypass in Pulpcore
> An authentication bypass vulnerability has been identified in Pulpcore
> when deployed by the Foreman Installer with Gunicorn versions prior to
> 22.0.
> This issue arises from the way Apache is configured to do certificate
> authentication and pass this information to the Gunicorn backend,
> without unsetting all headers coming from a possibly malicious client.
> * Affects Katello 4.0.0 and higher
> * Fix released in Foreman 3.10.1, 3.11.2, 3.12.0
> * GitHub PR puppet-pulpcore#357
>
>
> #### CVE-2024-7012: Authentication bypass in Foreman
> An authentication bypass vulnerability has been identified in Foreman
> when deployed by the Foreman Installer with External Authentication.
> This issue arises from the way Apache is configured to do certificate
> authentication and pass this information to the Puma backend,
> without unsetting all headers coming from a possibly malicious client.
> * Affects Foreman 2.2.0 and higher
> * Fix released in Foreman 3.10.1, 3.11.2, 3.12.0
> * GitHub PR puppet-foreman#1181




Further References:
[1] https://community.theforeman.org/t/foreman-3-11-2-is-now-available/39370
[2] https://theforeman.org/security.html#2024-7923
[3] https://access.redhat.com/security/cve/CVE-2024-7012
[4] https://access.redhat.com/security/cve/CVE-2024-7923
https://projects.theforeman.org/issues/37786?tab=changesets
https://projects.theforeman.org/issues/37787?tab=changesets


Kind regards,
Christian

not affiliated in any way, but I think the following two critical Foreman & Pulpcore vulnerabilities [1] are worth mentioning here: Foreman is also used as part of other projects such as Red Hat Satellite, which is also documented to be affected [3][4].

OpenPGP_signature.asc
Description: OpenPGP digital signature