We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-7923

Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore



Assignerredhat
Reserved2024-08-19
Published2024-09-04
Updated2024-09-05

Description

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.



CRITICAL: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Authentication

Product status

Default status
0x40028d20f0

1:3.5.2.8-1.el8sat before *
unaffected

Default status
0x40028d2170

1:3.5.2.8-1.el8sat before *
unaffected

Default status
0x40028d21f0

1:3.7.0.8-1.el8sat before *
unaffected

Default status
0x40028d2270

1:3.7.0.8-1.el8sat before *
unaffected

Default status
0x40028d22f0

1:3.9.3.4-1.el8sat before *
unaffected

Default status
0x40028d2370

1:3.9.3.4-1.el8sat before *
unaffected

Timeline

2024-08-19:Reported to Red Hat.
2024-09-04:Made public.

References

https://access.redhat.com/errata/RHSA-2024:6335 (RHSA-2024:6335) vendor-advisory

https://access.redhat.com/errata/RHSA-2024:6336 (RHSA-2024:6336) vendor-advisory

https://access.redhat.com/errata/RHSA-2024:6337 (RHSA-2024:6337) vendor-advisory

https://access.redhat.com/security/cve/CVE-2024-7923 vdb-entry

https://bugzilla.redhat.com/show_bug.cgi?id=2305718 (RHBZ#2305718) issue-tracking

cve.org CVE-2024-7923

nvd.nist.gov CVE-2024-7923

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-7923
Subscribe to our newsletter to learn more about our work.