Description
Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman-proxy | 1.6.0.33-1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite Capsule 6 | katello-agent | 1.5.3-7.el6sat | RHBA-2015:0054 |
| Red Hat Satellite Capsule 6 | katello-installer | 0.0.67-1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite Capsule 6 | pulp +15 | 2.4.4-1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite Capsule 6 | pulp-rpm +4 | 2.4.4-1.1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite 6 | foreman +6 | 1.6.0.51-1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite 6 | foreman-proxy | 1.6.0.33-1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite 6 | katello-agent | 1.5.3-7.el6sat | RHBA-2015:0054 |
| Red Hat Satellite 6 | katello-installer | 0.0.67-1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite 6 | pulp +16 | 2.4.4-1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite 6 | pulp-rpm +4 | 2.4.4-1.1.el6sat | RHBA-2015:0054 |
| Red Hat Satellite 6 | ruby193-rubygem-fog | 1.21.0-3.2.el6sat | RHBA-2015:0054 |
| Red Hat Satellite 6 | ruby193-rubygem-foreman-tasks | 0.6.9-1.2.el6sat | RHBA-2015:0054 |
| Red Hat Openstack-installer 5 | foreman-proxy | 1.6.0.33-2.el6ost | RHSA-2015:0287 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | foreman-proxy | 1.3.0-7.el6ost | RHSA-2015:0288 |
Advisories 3
- RHSA-2015:0288 Red Hat Security Advisory: foreman-proxy security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2015:0287 Red Hat Security Advisory: foreman-proxy security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHBA-2015:0054 Red Hat Bug Fix Advisory: Red Hat Satellite 6 server bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026