CVE-2021-3469

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1943630	Issue Tracking Mitigation Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1943630	Issue Tracking Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:21

Type	Values Removed	Values Added
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=1943630 - Issue Tracking, Mitigation, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=1943630 - Issue Tracking, Mitigation, Third Party Advisory

Information

Published : 2021-06-03 20:15

Updated : 2024-11-21 06:21

NVD link : CVE-2021-3469

Mitre link : CVE-2021-3469

CVE.ORG link : CVE-2021-3469

JSON object : View

Products Affected

theforeman

foreman

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2021-3469", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2021-06-03T20:15:08.617", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1943630", "tags": ["Issue Tracking", "Mitigation", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1943630", "tags": ["Issue Tracking", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly."}, {"lang": "es", "value": "Foreman versiones anteriores a 2.3.4 y versiones anteriores a 2.4.0, est\u00e1n afectadas por un fallo en el manejo de la autorizaci\u00f3n. Un atacante autenticado puede hacerse pasar por el foreman-proxy si el producto permite que la autoridad de certificados (CA) de Puppet firme peticiones de certificados que tengan nombres alternativos de sujeto (SAN). Foreman no habilita los SANs por defecto y la funci\u00f3n \"allow-authorization-extensions\" est\u00e1 ajustada en el par\u00e1metro \"false\" a menos que el usuario cambie la configuraci\u00f3n del archivo \"/etc/puppetlabs/puppetserver/conf.d/ca.conf\" expl\u00edcitamente"}], "lastModified": "2024-11-21T06:21:37.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA2204AF-3EAF-45DB-A73B-4B089E5EB946", "versionEndExcluding": "2.3.4"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}