ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΠΊΠΎΠΌΠΏΠΎΠ½Π΅Π½ΡΠ° /rpc/api ΠΏΡΠΎΠ³ΡΠ°ΠΌΠΌΠ½ΠΎΠ³ΠΎ ΡΡΠ΅Π΄ΡΡΠ²Π° Π΄Π»Ρ ΡΠΏΡΠ°Π²Π»Π΅Π½ΠΈΡ ΡΠΈΡΡΠ΅ΠΌΠ°ΠΌΠΈ Red Hat Spacewalk ΡΠ²ΡΠ·Π°Π½Π° Ρ Π½Π΅Π²Π΅ΡΠ½ΡΠΌ ΠΎΠ³ΡΠ°Π½ΠΈΡΠ΅Π½ΠΈΠ΅ΠΌ XML-ΡΡΡΠ»ΠΎΠΊ Π½Π° Π²Π½Π΅ΡΠ½ΠΈΠ΅ ΠΎΠ±ΡΠ΅ΠΊΡΡ. ΠΠΊΡΠΏΠ»ΡΠ°ΡΠ°ΡΠΈΡ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ ΠΌΠΎΠΆΠ΅Ρ ΠΏΠΎΠ·Π²ΠΎΠ»ΠΈΡΡ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ, Π΄Π΅ΠΉΡΡΠ²ΡΡΡΠ΅ΠΌΡ ΡΠ΄Π°Π»Π΅Π½Π½ΠΎ, ΡΠ°ΡΠΊΡΡΡΡ Π·Π°ΡΠΈΡΠ°Π΅ΠΌΡΡ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ ΠΈ Π²ΡΠ·Π²Π°ΡΡ ΠΎΡΠΊΠ°Π· Π² ΠΎΠ±ΡΠ»ΡΠΆΠΈΠ²Π°Π½ΠΈΠΈ ΠΈΠ»ΠΈ Π²ΡΠΏΠΎΠ»Π½ΠΈΡΡ ΠΏΡΠΎΠΈΠ·Π²ΠΎΠ»ΡΠ½ΡΠΉ ΠΊΠΎΠ΄
ΠΠ΅Π½Π΄ΠΎΡ
ΠΠ°ΠΈΠΌΠ΅Π½ΠΎΠ²Π°Π½ΠΈΠ΅ ΠΠ
ΠΠ΅ΡΡΠΈΡ ΠΠ
Π’ΠΈΠΏ ΠΠ
ΠΠΏΠ΅ΡΠ°ΡΠΈΠΎΠ½Π½ΡΠ΅ ΡΠΈΡΡΠ΅ΠΌΡ ΠΈ Π°ΠΏΠΏΠ°ΡΠ°ΡΠ½ΡΠ΅ ΠΏΠ»Π°ΡΡΠΎΡΠΌΡ
Π£ΡΠΎΠ²Π΅Π½Ρ ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
ΠΠΎΠ·ΠΌΠΎΠΆΠ½ΡΠ΅ ΠΌΠ΅ΡΡ ΠΏΠΎ ΡΡΡΡΠ°Π½Π΅Π½ΠΈΡ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
Π‘ΡΠ°ΡΡΡ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
ΠΠ°Π»ΠΈΡΠΈΠ΅ ΡΠΊΡΠΏΠ»ΠΎΠΉΡΠ°
ΠΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ ΠΎΠ± ΡΡΡΡΠ°Π½Π΅Π½ΠΈΠΈ
ΠΠ΄Π΅Π½ΡΠΈΡΠΈΠΊΠ°ΡΠΎΡΡ Π΄ΡΡΠ³ΠΈΡ ΡΠΈΡΡΠ΅ΠΌ ΠΎΠΏΠΈΡΠ°Π½ΠΈΠΉ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ
- CVE
EPSS
8.6 High
CVSS3
9 Critical
CVSS2
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.
EPSS
8.6 High
CVSS3
9 Critical
CVSS2