Mangelnde Rechteprüfung in katello-installer-base
ID: | RHSA-2019:0735-01 |
Distribution: | Red Hat |
Plattformen: | Red Hat Satellite 6 |
Datum: | Di, 9. April 2019, 22:41 |
Referenzen: | https://access.redhat.com/security/cve/CVE-2019-3845 |
Applikationen: | Katello |
Originalnachricht |
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: katello-installer-base security and enhancement update Advisory ID: RHSA-2019:0735-01 Product: Red Hat Satellite 6 Advisory URL: https://access.redhat.com/errata/RHSA-2019:0735 Issue date: 2019-04-09 CVE Names: CVE-2019-3845 ===================================================================== 1. Summary: An update for katello-installer-base which configures qpid-dispatch-router is now available for Red Hat Satellite 6.4 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Satellite 6.4 - noarch Red Hat Satellite Capsule 6.4 - noarch 3. Description: The qpid-dispatch-router package provides remote host management functionality and is configured through the katello-installer-base package. Additional packages included contain enhancements to support the fix. Security Fix(es): * qpid-dispatch-router: QMF methods exposed to goferd via qdrouterd (CVE-2019-3845) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. This issue was discovered by Pavel Moravec (Red Hat). 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/up grading_and_updating_red_hat_satellite/updating_satellite_server_capsule_se rver_and_content_hosts#updating_satellite_server_to_next_minor_version 5. Bugs fixed (https://bugzilla.redhat.com/): 1684275 - CVE-2019-3845 qpid-dispatch-router: QMF methods exposed to goferd via qdrouterd 6. Package List: Red Hat Satellite Capsule 6.4: Source: katello-installer-base-3.7.0.19-1.el7sat.src.rpm satellite-6.4.2.1-1.el7sat.src.rpm noarch: foreman-installer-katello-3.7.0.19-1.el7sat.noarch.rpm katello-installer-base-3.7.0.19-1.el7sat.noarch.rpm satellite-capsule-6.4.2.1-1.el7sat.noarch.rpm satellite-common-6.4.2.1-1.el7sat.noarch.rpm satellite-debug-tools-6.4.2.1-1.el7sat.noarch.rpm Red Hat Satellite 6.4: Source: katello-installer-base-3.7.0.19-1.el7sat.src.rpm satellite-6.4.2.1-1.el7sat.src.rpm noarch: foreman-installer-katello-3.7.0.19-1.el7sat.noarch.rpm katello-installer-base-3.7.0.19-1.el7sat.noarch.rpm satellite-6.4.2.1-1.el7sat.noarch.rpm satellite-capsule-6.4.2.1-1.el7sat.noarch.rpm satellite-cli-6.4.2.1-1.el7sat.noarch.rpm satellite-common-6.4.2.1-1.el7sat.noarch.rpm satellite-debug-tools-6.4.2.1-1.el7sat.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-3845 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is |