CVE-2018-14643: Improper Authentication

September 21, 2018 (updated October 9, 2019)

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.

References

www.securityfocus.com/bid/105375
access.redhat.com/errata/RHSA-2018:2733
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643
github.com/theforeman/smart_proxy_dynflow/pull/54
nvd.nist.gov/vuln/detail/CVE-2018-14643

Code Behaviors & Features

Detect and mitigate CVE-2018-14643 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →