RCE in Spacewalk Project
CVE-2021-40348
Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.018 (77.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Spacewalk_project Spacewalk — versions 2.10
- Uyuni-project Uyuni — versions 2021.08
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Patch, Mailing List, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-40348?
- CVE-2021-40348 is a high-severity vulnerability in Spacewalk Project, classified under Code Injection. CVSS score: 8.8/10. Published 2021-11-01.
- How severe is CVE-2021-40348?
- High severity. CVSS v3 base score is 8.8 out of 10.