RHSA-2016:1484 - Security Advisory

Topic

An update for spacewalk-java is now available for Red Hat Satellite 5.7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Satellite is a system management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and the remote management of multiple Linux deployments with a single, centralized tool.

Security Fix(es):

• A stored cross-site scripting (XSS) flaw was found in the way spacewalk-java displayed monitoring probes. An attacker can embed HTML and Javascript in the values for RHNMD User or Filesystem parameters in Satellite, allowing them to inject malicious content into the web page that is then displayed with that probe data. (CVE-2016-3080)
• A stored cross-site scripting (XSS) flaw was found in the way spacewalk-java displayed group names. An attacker can embed HTML and Javascript in the values for group names in Satellite, allowing them to inject malicious content into the web page that is then displayed when viewing the snapshot data. (CVE-2016-3097)

These issues were discovered by Jan Hutař (Red Hat).

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For this update to take effect, Red Hat Satellite must be restarted ("/usr/sbin/rhn-satellite restart").

Affected Products

• Red Hat Satellite 5.7 x86_64
• Red Hat Satellite 5.7 s390x

Fixes

• BZ - 1320942 - CVE-2016-3080 spacewalk-monitoring: XSS issue in monitoring probe
• BZ - 1322710 - XSS when you create group with HTML via SSM or API and checks snapshot with this group join/leave
• BZ - 1322747 - CVE-2016-3097 spacewalk-java: Multiple XSS flaws

CVEs

• CVE-2016-3080
• CVE-2016-3097

References

• http://www.redhat.com/security/updates/classification/#normal