We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-7923

Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore



Description

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.

Reserved 2024-08-19 | Published 2024-09-04 | Updated 2024-11-24 | Assigner redhat


CRITICAL: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Authentication

Product status

Default status
unaffected

Any version before 22.0
affected

Default status
affected

1:3.5.2.8-1.el8sat before *
unaffected

Default status
affected

1:3.5.2.8-1.el8sat before *
unaffected

Default status
affected

1:3.7.0.8-1.el8sat before *
unaffected

Default status
affected

1:3.7.0.8-1.el8sat before *
unaffected

Default status
affected

1:3.9.3.4-1.el8sat before *
unaffected

Default status
affected

1:3.9.3.4-1.el8sat before *
unaffected

Default status
affected

1:3.12.0.1-1.el8sat before *
unaffected

Default status
affected

1:3.12.0.1-1.el8sat before *
unaffected

Default status
affected

1:3.12.0.1-1.el9sat before *
unaffected

Default status
affected

1:3.12.0.1-1.el9sat before *
unaffected

Timeline

2024-08-19:Reported to Red Hat.
2024-09-04:Made public.

References

access.redhat.com/errata/RHSA-2024:6335 (RHSA-2024:6335) vendor-advisory

access.redhat.com/errata/RHSA-2024:6336 (RHSA-2024:6336) vendor-advisory

access.redhat.com/errata/RHSA-2024:6337 (RHSA-2024:6337) vendor-advisory

access.redhat.com/errata/RHSA-2024:8906 (RHSA-2024:8906) vendor-advisory

access.redhat.com/security/cve/CVE-2024-7923 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2305718 (RHBZ#2305718) issue-tracking

cve.org (CVE-2024-7923)

nvd.nist.gov (CVE-2024-7923)

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-7923

Support options

Helpdesk Chat, Email, Knowledgebase
Subscribe to our newsletter to learn more about our work.