Description
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | spacewalk-backend | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | spacewalk-backend +16 | 2.0.3-45.el5sat | RHSA-2017:1259 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | rhnlib | 2.5.84.4-8.1 | SUSE-SU-2017:1347-1 |
| SLES 11 SP4 | spacecmd | 2.5.5.5-14.1 | SUSE-SU-2017:1347-1 |
| SLES 11 SP4 | spacewalk-backend | 2.5.24.9-24.1 | SUSE-SU-2017:1347-1 |
| SLES 11 SP4 | spacewalk-client-tools | 2.5.13.8-23.1 | SUSE-SU-2017:1347-1 |
| SLES 11 SP3 | rhnlib | 2.5.84.4-8.1 | SUSE-SU-2017:1347-1 |
| SLES 11 SP3 | spacecmd | 2.5.5.5-14.1 | SUSE-SU-2017:1347-1 |
| SLES 11 SP3 | spacewalk-backend | 2.5.24.9-24.1 | SUSE-SU-2017:1347-1 |
| SLES 11 SP3 | spacewalk-client-tools | 2.5.13.8-23.1 | SUSE-SU-2017:1347-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server 3.0 | rhnlib | 2.5.84.4-6.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | salt-netapi-client | 0.11.1-12.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | spacecmd | 2.5.5.5-12.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | spacewalk-backend | 2.5.24.9-22.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | spacewalk-certs-tools | 2.5.1.8-17.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | spacewalk-client-tools | 2.5.13.8-17.2 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | spacewalk-java | 2.5.59.14-23.2 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | spacewalk-reports | 2.5.1.2-3.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | spacewalk-setup | 2.5.3.12-15.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | spacewalk-web | 2.5.7.15-21.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | subscription-matcher | 0.18-5.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | susemanager | 3.0.21-21.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | susemanager-schema | 3.0.19-21.2 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | susemanager-sls | 0.1.20-23.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | susemanager-sync-data | 3.0.16-24.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Server 3.0 | virtual-host-gatherer | 1.0.13-6.1 | SUSE-SU-2017:1349-1 |
| SUSE Manager Proxy 3.0 | rhnlib | 2.5.84.4-6.1 | SUSE-SU-2017:1346-1 |
| SUSE Manager Proxy 3.0 | spacewalk-backend | 2.5.24.9-22.1 | SUSE-SU-2017:1346-1 |
| SUSE Manager Proxy 3.0 | spacewalk-certs-tools | 2.5.1.8-17.1 | SUSE-SU-2017:1346-1 |
| SUSE Manager Proxy 3.0 | spacewalk-client-tools | 2.5.13.8-17.2 | SUSE-SU-2017:1346-1 |
| SUSE Manager Proxy 3.0 | spacewalk-proxy | 2.5.1.7-15.1 | SUSE-SU-2017:1346-1 |
| SUSE Manager Proxy 3.0 | spacewalk-proxy-installer | 2.5.2.5-6.1 | SUSE-SU-2017:1346-1 |
| SUSE Manager Proxy 3.0 | spacewalk-web | 2.5.7.15-21.1 | SUSE-SU-2017:1346-1 |
| SUSE Manager Proxy 3.0 | susemanager-sls | 0.1.20-23.1 | SUSE-SU-2017:1346-1 |
| SUSE Manager Client Tools 12 | cobbler | 2.6.6-45.1 | SUSE-SU-2017:1352-1 |
| SUSE Manager Client Tools 12 | rhnlib | 2.5.84.4-17.1 | SUSE-SU-2017:1352-1 |
| SUSE Manager Client Tools 12 | spacecmd | 2.5.5.5-34.1 | SUSE-SU-2017:1352-1 |
| SUSE Manager Client Tools 12 | spacewalk-backend | 2.5.24.9-51.1 | SUSE-SU-2017:1352-1 |
| SUSE Manager Client Tools 12 | spacewalk-client-tools | 2.5.13.8-48.1 | SUSE-SU-2017:1352-1 |
Advisories 5
- RHSA-2017:1259 Red Hat Security Advisory: spacewalk-backend security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- SUSE-SU-2017:1349-1 Security update for SUSE Manager Server 3.0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1352-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1346-1 Security update for SUSE Manager Proxy 3.0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1347-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · May 2, 2025
References
- RHSA-2017:1259 vendor-advisory
- 98569 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7470