Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pcs: Cross-Site Request Forgery in web UI (CVE-2016-0720)

  - Session fixation vulnerability in pcsd in pcs before 0.9.157. (CVE-2016-0721)

  - ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to     improper validation of Node name field when creating new cluster or adding existing cluster.
    (CVE-2017-2661)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1313 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * foreman: Managing repositories with their id via hammer does not respect the role filters     (CVE-2017-2662)
    * python-psutil: Double free because of refcount mishandling (CVE-2019-18874)
    * candlepin: netty: compression/decompression codecs don't enforce limits on buffer allocation sizes     (CVE-2020-11612)
    * foreman: world-readable OMAPI secret through the ISC DHCP server (CVE-2020-14335)
    * candlepin: resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)
    * python-django: potential SQL injection via tolerance parameter in GIS functions and aggregates on     Oracle (CVE-2020-9402)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    * Usability enhancements to Red Hat's Simple Content Access mode and Satellite

    * Usability improvements to enabling Remote Execution on your hosts.

    * Notifications in the UI to warn users when subscriptions are expiring.

    * Usability enhancements to enable Insights integration with Satellite.

    * Performance improvements to various aspects of the user interface and API.

    * Added support for OpenID Connect for authentication.

    * Usability improvements to the Satellite Installer.

    * Updated Ruby web server to the modern Puma application server which replaces Passenger.

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4366 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)
    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)
    * rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)
    * puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)
    * jackson-databind: multiple serialization gadgets (CVE-2020-8840 CVE-2020-9546 CVE-2020-9547     CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11619 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195)
    * foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)
    * Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover     (CVE-2020-14380)
    * Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)
    * rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)
    * rubygem-secure_headers: limited header injection when using dynamic overrides with user input     (CVE-2020-5216)
    * rubygem-secure_headers: directive injection when using dynamic overrides with user input (CVE-2020-5217)
    * rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks     (CVE-2020-5267)
    * puppet: Arbitrary catalog retrieval (CVE-2020-7942)
    * rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)
    * rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names     (CVE-2020-8184)
    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)
    * puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL     (CVE-2018-11751)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    * Provides the Satellite Ansible Modules that allow for full automation of your Satellite configuration     and deployment.

    * Adds ability to install Satellite and Capsules and manage hosts in a IPv6 network environment

    * Ansible based Capsule Upgrade automation: Ability to centrally upgrade all of your Capsule servers with     a single job execution.

    * Platform upgrades to Postgres 12, Ansible 2.9, Ruby on Rails and latest version of Puppet

    * Support for HTTP UEFI provisioning

    * Support for CAC card authentication with Keycloak integration

    * Add ability to upgrade Red Hat Enterprise Linux 7 hosts to version 8 using the LEAPP based tooling.

    * Support for Red Hat Enterprise Linux Traces integration

    * satellite-maintain & foreman-maintain are now self updating

    * Notifications in the UI to warn users when subscriptions are expiring.

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pcs packages installed that are affected by multiple vulnerabilities:

  - Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and     earlier contains a timing attack vulnerability in the     CSRF token checking that can result in signatures can be     exposed. This attack appear to be exploitable via     network connectivity to the ruby application. This     vulnerability appears to have been fixed in 1.5.5 and     2.0.0. (CVE-2018-1000119)

  - It was found that the REST interface of the pcsd service     did not properly sanitize the file name from the     /remote/put_file query. If the /etc/booth directory     exists, an authenticated attacker with write permissions     could create or overwrite arbitrary files with arbitrary     data outside of the /etc/booth directory, in the context     of the pcsd process. (CVE-2018-1079)

  - It was found that the REST interface of the pcsd service     did not properly remove the pcs debug argument from the     /run_pcs query, possibly disclosing sensitive     information. A remote attacker with a valid token could     use this flaw to elevate their privilege.
    (CVE-2018-1086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A timing attack was discovered in the function for CSRF token validation of the 'Ruby rack protection' framework.

An update for pcs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es) :

* pcs: Privilege escalation via authorized user malicious REST call (CVE-2018-1079)

* pcs: Debug parameter removal bypass, allowing information disclosure (CVE-2018-1086)

* rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The CVE-2018-1079 issue was discovered by Ondrej Mular (Red Hat) and the CVE-2018-1086 issue was discovered by Cedric Buissart (Red Hat).

Security Fix(es) :

  - pcs: Privilege escalation via authorized user malicious     REST call (CVE-2018-1079)

  - pcs: Debug parameter removal bypass, allowing     information disclosure (CVE-2018-1086)

  - rack-protection: Timing attack in authenticity_token.rb     (CVE-2018-1000119)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1060 advisory.

    - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
    - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
    - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Debug parameter removal bypass, allowing information disclosure

It was found that the REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.
(CVE-2018-1086)

Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
(CVE-2018-1000119)

Privilege escalation via authorized user malicious REST call

It was found that the REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process. (CVE-2018-1079)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1060 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * pcs: Privilege escalation via authorized user malicious REST call (CVE-2018-1079)

    * pcs: Debug parameter removal bypass, allowing information disclosure (CVE-2018-1086)

    * rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    The CVE-2018-1079 issue was discovered by Ondrej Mular (Red Hat) and the CVE-2018-1086 issue was     discovered by Cedric Buissart (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199124	RHEL 6 : pcs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
148903	RHEL 7 : Satellite 6.9 Release (Moderate) (RHSA-2021:1313)	Nessus	Red Hat Local Security Checks	critical
142452	RHEL 7 : Satellite 6.8 (Important) (RHSA-2020:4366)	Nessus	Red Hat Local Security Checks	critical
127219	NewStart CGSL CORE 5.04 / MAIN 5.04 : pcs Multiple Vulnerabilities (NS-SA-2019-0042)	Nessus	NewStart CGSL Local Security Checks	high
111112	Debian DSA-4247-1 : ruby-rack-protection - security update	Nessus	Debian Local Security Checks	medium
110237	CentOS 7 : pcs (CESA-2018:1060)	Nessus	CentOS Local Security Checks	high
109456	Scientific Linux Security Update : pcs on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	high
109438	Oracle Linux 7 : pcs (ELSA-2018-1060)	Nessus	Oracle Linux Local Security Checks	high
109365	Amazon Linux 2 : pcs (ALAS-2018-1005)	Nessus	Amazon Linux Local Security Checks	high
108996	RHEL 7 : pcs (RHSA-2018:1060)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-1000119

medium

Tenable Plugins

high

critical

critical

high

medium

high

high

high

high

high