Foreman: host ssh key not being checked in remote execution
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw can lead to a man-in-the-middle attack (MITM), denial of service, leaking of secrets the remote execution job contains, or other issues that may arise from the attacker's ability to forge an SSH key. This issue does not directly allow unauthorized remote execution on the Satellite, although it can leak secrets that may lead to it.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- foreman
3.9.1.8
- candlepin
Version range not reported
- foreman
Version range not reported
- foreman-installer
Version range not reported
- python-pulp-container
Version range not reported
- python-pulpcore
Version range not reported
- rubygem-dynflow
Version range not reported
- rubygem-foreman_ansible
Version range not reported
- rubygem-foreman_remote_execution
Version range not reported
- rubygem-katello
Version range not reported
- rubygem-smart_proxy_container_gateway
Version range not reported
- rubygem-smart_proxy_remote_execution_ssh
Version range not reported
- satellite
Version range not reported