Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:0089-1

Опубликовано: 12 янв. 2021
Источник: suse-cvrf

Описание

Security update for hawk2

This update for hawk2 fixes the following security issue:

  • CVE-2020-35458: Fixed an insufficient input handler that could have led to remote code execution (bsc#1179998).

Список пакетов

Image SLES12-SP4-SAP-Azure
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-Azure-BYOS
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-Azure-LI-BYOS-Production
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-EC2-HVM
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-EC2-HVM-BYOS
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-GCE
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-GCE-BYOS
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-OCI-BYOS
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-Azure-SAP-BYOS
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-Azure-SAP-On-Demand
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-EC2-SAP-BYOS
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-EC2-SAP-On-Demand
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-GCE-SAP-BYOS
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-GCE-SAP-On-Demand
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-OCI-BYOS-SAP-BYOS
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
SUSE Linux Enterprise High Availability Extension 12 SP4
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
SUSE Linux Enterprise High Availability Extension 12 SP5
hawk2-2.4.0+git.1607523195.05cd3222-3.21.1

Ссылки

Описание

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.

Затронутые продукты
Image SLES12-SP4-SAP-Azure-BYOS:hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Image SLES12-SP4-SAP-Azure:hawk2-2.4.0+git.1607523195.05cd3222-3.21.1
Ссылки
Уязвимость SUSE-SU-2021:0089-1