Описание
Security update for hawk2
This update for hawk2 fixes the following issues:
hawk2 was updated to version 2.4.0+git.1611141202.2fe6369e.
Security issue fixed:
- Fixed another possible code execution vulnerability in the controller code (bsc#1179998).
This update was imported from the SUSE:SLE-15:Update update project.
Список пакетов
openSUSE Leap 15.2
hawk2-2.4.0+git.1611141202.2fe6369e-lp152.2.12.1
Ссылки
- E-Mail link for openSUSE-SU-2021:0144-1
- SUSE Security Ratings
- SUSE Bug 1179998
- SUSE CVE CVE-2020-35458 page
Описание
An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.
Затронутые продукты
openSUSE Leap 15.2:hawk2-2.4.0+git.1611141202.2fe6369e-lp152.2.12.1
Ссылки
- CVE-2020-35458
- SUSE Bug 1179998