CVE-2017-2662: Improper Privilege Management

August 22, 2018 (updated October 9, 2019)

A flaw was found in Foreman’s katello plugin. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662
nvd.nist.gov/vuln/detail/CVE-2017-2662
projects.theforeman.org/issues/18838

Code Behaviors & Features

Detect and mitigate CVE-2017-2662 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →