Red Hat Security Advisory: Red Hat Satellite 6.1.1 on RHEL 7

Fixed packages 400

Vulnerabilities 8

• Critical 9.8
  CVE-2009-3555 Public exploit EPSS 87%

  Apache Tomcat affected by vulnerability in TLS and SSL protocol

  The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Serv…

  openssl apache2 org.apache.tomcat:tomcat nss Debian Maven
  Nov 9, 2009
• High 7.5
  CVE-2013-4346

  SimpleGeo python-oauth2 does not check the nonce allowing replay attacks

  The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.

  oauth2 PyPI
  May 20, 2014
• Low 3.7
  CVE-2013-4347

  SimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces

  The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.

  oauth2 PyPI
  May 20, 2014
• Unscored —
  CVE-2014-3653

  Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attacke…

  Jul 6, 2015
• Unscored —
  CVE-2015-1816

  Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to …

  Aug 14, 2015
• Unscored —
  CVE-2015-1844

  Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting t…

  Aug 14, 2015
• Unscored —
  CVE-2015-3155

  Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier…

  Aug 14, 2015
• Unscored —
  CVE-2015-3235

  Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and c…

  Aug 14, 2015

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.1/html/Release_Notes/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1007746
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1007758
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1145398
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1201357
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1207589
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1208602
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1216035
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1232366
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1591.json
• report
  https://access.redhat.com/security/cve/CVE-2009-3555
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=533125
• advisory
  https://www.cve.org/CVERecord?id=CVE-2009-3555
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2009-3555
• report
  https://access.redhat.com/security/cve/CVE-2013-4346
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4346
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4346
• report
  https://access.redhat.com/security/cve/CVE-2013-4347
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4347
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4347
• report
  https://access.redhat.com/security/cve/CVE-2014-3653
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-3653
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-3653
• report
  https://access.redhat.com/security/cve/CVE-2015-1816
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-1816
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-1816
• report
  https://access.redhat.com/security/cve/CVE-2015-1844
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-1844
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-1844
• report
  https://access.redhat.com/security/cve/CVE-2015-3155
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-3155
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-3155
• report
  https://access.redhat.com/security/cve/CVE-2015-3235
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-3235
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-3235