CVE-2024-7012

Puppet-foreman: an authentication bypass vulnerability exists in foreman

View on CVE.org
Published Sep 4, 2024 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-48827 An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.
History
Type Values Removed Values Added
First Time appeared Redhat satellite Maintenance
CPEs cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_maintenance:6.16::el8
cpe:/a:redhat:satellite_maintenance:6.16::el9
cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_utils:6.16::el9
Vendors & Products Redhat satellite Maintenance
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:redhat:satellite:6.13:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.14:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.15:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Redhat satellite Capsule
Redhat satellite Utils
CPEs cpe:/a:redhat:satellite:6 cpe:/a:redhat:satellite:6.13::el8
cpe:/a:redhat:satellite:6.14::el8
cpe:/a:redhat:satellite:6.15::el8
cpe:/a:redhat:satellite_capsule:6.13::el8
cpe:/a:redhat:satellite_capsule:6.14::el8
cpe:/a:redhat:satellite_capsule:6.15::el8
cpe:/a:redhat:satellite_utils:6.13::el8
cpe:/a:redhat:satellite_utils:6.14::el8
cpe:/a:redhat:satellite_utils:6.15::el8
Vendors & Products Redhat satellite Capsule
Redhat satellite Utils
References
Metrics threat_severity

None

 threat_severity

Critical
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Description An authentication bypass vulnerability has been identified in Foreman when deployed with Gunicorn versions prior to 22.0, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access. An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.
Type Values Removed Values Added
Description An authentication bypass vulnerability has been identified in Foreman when deployed with Gunicorn versions prior to 22.0, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.
Title Puppet-foreman: an authentication bypass vulnerability exists in foreman
First Time appeared Redhat
Redhat satellite
Weaknesses CWE-287
CPEs cpe:/a:redhat:satellite:6
Vendors & Products Redhat
Redhat satellite
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (4)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 11, 2025, 3:29 PM
Reserved
Jul 23, 2024, 5:02 AM

View source JSON

Updated
Sep 4, 2024, 2:18 PM

JSON

Status
Modified
Published
Sep 4, 2024, 2:15 PM
Modified
Jun 17, 2026, 8:19 AM

View source JSON

Severity
Critical
Public date
Sep 4, 2024, 1:14 PM

View source Bugzilla JSON

No data.