RCE in Spacewalk Project
CVE-2021-40348
Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.018 (78.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Spacewalk Project — versions 2.10
- Uyuni-Project Uyuni — versions 2021.08
Weakness classification (CWE)
References
- www.openwall.com/lists/oss-security/2021/10/28/4 (Exploit, Patch, Mailing List, Third Party Advisory)
- github.com/uyuni-project/uyuni/commit/790c7388efac6923c5475e01c1ff718dffa9f052 (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-40348?
- CVE-2021-40348 is a high-severity vulnerability in Spacewalk Project, classified under Code Injection. CVSS score: 8.8/10. Published 2021-11-01.
- How severe is CVE-2021-40348?
- High severity. CVSS v3 base score is 8.8 out of 10.