CVE-2017-7513 Security feature bypass in Red Hat Satellite
Man-in-the-middle attackers can spoof PostgreSQL servers due to missing X.509 hostname validation in Red Hat Satellite SSL configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-7513?
CVE-2017-7513 is a medium-severity vulnerability in Redhat Satellite, published on 22 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a PostgreSQL server using a specially crafted X.509 certificate.
Weakness: CWE-295
Which versions are affected by CVE-2017-7513?
It affects 1 product.
Products include Redhat Satellite.
How do I fix CVE-2017-7513?
No fix has been published for CVE-2017-7513 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-7513 being exploited?
There is no known exploitation of CVE-2017-7513 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
- CVE-2023-0118 Foreman: arbitrary code execution through templates
- CVE-2008-2369 Hardcoded credentials in n/a
Sources
Also known as GHSA-c2vg-q78p-66vp.