CVE-2019-10137 Path traversal in spacewalk-proxy
Remote unauthenticated attackers can exploit a path traversal flaw in Spacewalk proxy to read arbitrary files or execute code via cached client tokens.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10137?
CVE-2019-10137 is a high-severity path traversal vulnerability in Redhat Satellite, published on 2 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.
Weakness: CWE-22
Which versions are affected by CVE-2019-10137?
It affects 2 products.
Linux distribution packages (8)
spacewalk-backend Red Hat:network_proxy:5.8::el6 | All versions | 0:2.5.3-177.el6sat |
spacewalk-backend-libs Red Hat:network_proxy:5.8::el6 | All versions | 0:2.5.3-177.el6sat |
spacewalk-proxy Red Hat:network_proxy:5.8::el6 | All versions | 0:2.5.0-8.el6sat |
spacewalk-proxy-broker Red Hat:network_proxy:5.8::el6 | All versions | 0:2.5.0-8.el6sat |
spacewalk-proxy-common Red Hat:network_proxy:5.8::el6 | All versions | 0:2.5.0-8.el6sat |
spacewalk-proxy-management Red Hat:network_proxy:5.8::el6 | All versions | 0:2.5.0-8.el6sat |
spacewalk-proxy-package-manager Red Hat:network_proxy:5.8::el6 | All versions | 0:2.5.0-8.el6sat |
spacewalk-proxy-redirect Red Hat:network_proxy:5.8::el6 | All versions | 0:2.5.0-8.el6sat |
Products include Redhat Satellite, Redhat Spacewalk.
How do I fix CVE-2019-10137?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-10137 being exploited?
There is no known exploitation of CVE-2019-10137 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
- CVE-2023-0118 Foreman: arbitrary code execution through templates
- CVE-2008-2369 Hardcoded credentials in n/a
Sources
Also known as GHSA-38jq-w3g8-jpc9, RHSA-2019:1663.