Vulnerability in Theforeman Foreman

CVE-2014-0007

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

EPSS: 0.090 (94.7th percentile) — read the EPSS interpretation.

Affected products

Theforeman Foreman — versions 1.4.0, 1.4.1, 1.4.2
N/a — versions n/a

References

secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)