7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
70.6%
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5602 advisory.
Red Hat Update Infrastructure (RHUI) offers a highly scalable, highly redundant framework that enables you to manage repositories and content. It also enables cloud providers to deliver content and updates to Red Hat Enterprise Linux (RHEL) instances.
Security Fix(es):
* Django: SQL injection via QuerySet's annotate, aggregate, and extra functions (CVE-2022-28346)
* Django: SQL injection via QuerySet's explain function on PostgreSQL (CVE-2022-28347)
This update fixes the following bugs:
* Previously, when a path for a non-RHUI repository was used in the entitlement certificate, RHUI Manager logged the following error message in the `/var/log/messages` file:
...
Invalid entitlement path %s found ...
With this update, the error message has been clarified and reworded to the following message:
...
Invalid repository download URL: %s provided ...
In addition, this RHUI update introduces the following enhancements:
* With this update, containers are now supported on RHUI. You can perform the following operations:
** Add containers to RHUI
** Synchronize these containers regularly along with containers from `registry.redhat.io` or any other registry of your choice
** Offer the containers to client virtual machines using a special client configuration RPM. You can create the configuration RPM using the `rhui-manager` text user interface.
* With this update, the repository synchronization status, the validity status of the RHUI CA certificate, and the statuses of services running on the RHUA, CDS, and HAProxy nodes are now available. In the case of services running on the nodes, you can view the statuses by running the `rhui-manager status` command on the RHUA node.(BZ#1636435)
* With this update, you can specify the following certificates and keys during RHUI installation:
** Custom CA certificates and keys on the RHUA node
** Custom CA certificate and key that will be used to generate client entitlement certificates
** Custom CA certificate and key that will be used to generate client SSL certificates
** Custom SSL certificate and key for the web server when adding a CDS node. Note that this certificate must be usable for all the load balancers and CDS host names that you are using with your RHUI installation(BZ#2010343)
* Previously, you could only access repositories by using paths with the `/pulp/content` prefix. With this update, you can now access repositories using paths containing other predefined prefixes. In addition, you can also configure protected and unprotected custom repositories to use custom prefixes.(BZ#2079376)
Users of RHUI are advised to upgrade to these updated packages that fix these bugs and add these enhancements.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2022:5602. The text
# itself is copyright (C) Red Hat, Inc.
##
include('compat.inc');
if (description)
{
script_id(194273);
script_version("1.1");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/06/03");
script_cve_id("CVE-2022-28346", "CVE-2022-28347");
script_xref(name:"RHSA", value:"2022:5602");
script_name(english:"RHEL 8 : RHUI 4.1.1 - Security Fixes and Enhancement Update (Important) (RHSA-2022:5602)");
script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as
referenced in the RHSA-2022:5602 advisory.
Red Hat Update Infrastructure (RHUI) offers a highly scalable, highly redundant framework that enables you
to manage repositories and content. It also enables cloud providers to deliver content and updates to Red
Hat Enterprise Linux (RHEL) instances.
Security Fix(es):
* Django: SQL injection via QuerySet's annotate, aggregate, and extra functions (CVE-2022-28346)
* Django: SQL injection via QuerySet's explain function on PostgreSQL (CVE-2022-28347)
This update fixes the following bugs:
* Previously, when a path for a non-RHUI repository was used in the entitlement certificate, RHUI Manager
logged the following error message in the `/var/log/messages` file:
...
Invalid entitlement path %s found
...
With this update, the error message has been clarified and reworded to the following message:
...
Invalid repository download URL: %s provided
...
In addition, this RHUI update introduces the following enhancements:
* With this update, containers are now supported on RHUI. You can perform the following operations:
** Add containers to RHUI
** Synchronize these containers regularly along with containers from `registry.redhat.io` or any other
registry of your choice
** Offer the containers to client virtual machines using a special client configuration RPM. You can
create the configuration RPM using the `rhui-manager` text user interface.
* With this update, the repository synchronization status, the validity status of the RHUI CA certificate,
and the statuses of services running on the RHUA, CDS, and HAProxy nodes are now available. In the case of
services running on the nodes, you can view the statuses by running the `rhui-manager status` command on
the RHUA node.(BZ#1636435)
* With this update, you can specify the following certificates and keys during RHUI installation:
** Custom CA certificates and keys on the RHUA node
** Custom CA certificate and key that will be used to generate client entitlement certificates
** Custom CA certificate and key that will be used to generate client SSL certificates
** Custom SSL certificate and key for the web server when adding a CDS node. Note that this certificate
must be usable for all the load balancers and CDS host names that you are using with your RHUI
installation(BZ#2010343)
* Previously, you could only access repositories by using paths with the `/pulp/content` prefix. With this
update, you can now access repositories using paths containing other predefined prefixes. In addition, you
can also configure protected and unprotected custom repositories to use custom prefixes.(BZ#2079376)
Users of RHUI are advised to upgrade to these updated packages that fix
these bugs and add these enhancements.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/updates/classification/#important");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1636435");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1890389");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2010343");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2072447");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2072459");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2079376");
# https://access.redhat.com/security/data/csaf/v2/advisories/2022/rhsa-2022_5602.json
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2113052e");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2022:5602");
script_set_attribute(attribute:"solution", value:
"Update the affected python38-pulpcore package.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-28347");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_cwe_id(89);
script_set_attribute(attribute:"vendor_severity", value:"Important");
script_set_attribute(attribute:"vuln_publication_date", value:"2022/04/12");
script_set_attribute(attribute:"patch_publication_date", value:"2022/07/19");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/04/28");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-django");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pulpcore");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python38-pulpcore");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Red Hat Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
include('rhel.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
var constraints = [
{
'repo_relative_urls': [
'content/dist/layered/rhel8/x86_64/rhui/4/debug',
'content/dist/layered/rhel8/x86_64/rhui/4/os',
'content/dist/layered/rhel8/x86_64/rhui/4/source/SRPMS'
],
'pkgs': [
{'reference':'python38-pulpcore-3.17.6-3.el8ui', 'release':'8', 'el_string':'el8ui', 'rpm_spec_vers_cmp':TRUE, 'cves':['CVE-2022-28347']}
]
}
];
var applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);
if(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);
var flag = 0;
foreach var constraint_array ( constraints ) {
var repo_relative_urls = NULL;
if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];
foreach var pkg ( constraint_array['pkgs'] ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
var exists_check = NULL;
var cves = NULL;
if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
if (reference &&
_release &&
rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&
(applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&
rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
}
}
if (flag)
{
var extra = NULL;
if (isnull(applicable_repo_urls) || !applicable_repo_urls) extra = rpm_report_get() + redhat_report_repo_caveat();
else extra = rpm_report_get();
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : extra
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python38-pulpcore');
}
Vendor | Product | Version | CPE |
---|---|---|---|
redhat | enterprise_linux | python-pulpcore | p-cpe:/a:redhat:enterprise_linux:python-pulpcore |
redhat | enterprise_linux | python38-pulpcore | p-cpe:/a:redhat:enterprise_linux:python38-pulpcore |
redhat | enterprise_linux | python-django | p-cpe:/a:redhat:enterprise_linux:python-django |
redhat | enterprise_linux | 8 | cpe:/o:redhat:enterprise_linux:8 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28346
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28347
www.nessus.org/u?2113052e
access.redhat.com/errata/RHSA-2022:5602
access.redhat.com/security/updates/classification/#important
bugzilla.redhat.com/show_bug.cgi?id=1636435
bugzilla.redhat.com/show_bug.cgi?id=1890389
bugzilla.redhat.com/show_bug.cgi?id=2010343
bugzilla.redhat.com/show_bug.cgi?id=2072447
bugzilla.redhat.com/show_bug.cgi?id=2072459
bugzilla.redhat.com/show_bug.cgi?id=2079376
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
70.6%