Synopsis

Moderate: spacewalk-backend security update

Type/Severity

Security Advisory: Moderate

Topic

An update for spacewalk-backend is now available for Red Hat Satellite 5.6 and Red Hat Satellite 5.7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Spacewalk is an Open Source systems management solution that provides system provisioning, configuration and patching capabilities.

Security Fix(es):

• It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py. (CVE-2017-7470)
  

Red Hat would like to thank Bert Stel (SUSE) for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For this update to take effect, Red Hat Satellite must be restarted ("/usr/sbin/rhn-satellite restart").

Affected Products

• Red Hat Satellite 5.7 x86_64
• Red Hat Satellite 5.7 s390x
• Red Hat Satellite 5.6 x86_64
• Red Hat Satellite 5.6 s390x

Fixes

• BZ - 1439622 - CVE-2017-7470 spacewalk-backend: spacewalk-channel can be used by non-admin or disabled users for performing administrative tasks

CVEs

• CVE-2017-7470

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Satellite 5.7

SRPM
spacewalk-backend-2.3.3-49.el6sat.src.rpm	SHA-256: cf836ce165d0214946017277a0c29fd47ab767b7222b14570281f6ef48be5733
x86_64
spacewalk-backend-2.3.3-49.el6sat.noarch.rpm	SHA-256: 2ed7653fd9286f14ca9f02ce6ae1d4ea4119a8a7497052290372a7a126024c58
spacewalk-backend-app-2.3.3-49.el6sat.noarch.rpm	SHA-256: 247e83483194110ae1e7e427f815bb76e6830b917d8b1d64524dc0493cd9cf6b
spacewalk-backend-applet-2.3.3-49.el6sat.noarch.rpm	SHA-256: 746ee1143a2a85efb51dff923398a94e2b9155ea37516954e7b77932d57d4f9b
spacewalk-backend-config-files-2.3.3-49.el6sat.noarch.rpm	SHA-256: b646793ee28ff4181c0f07be52c527c324275a5d081a14818b8556f3b38eb55d
spacewalk-backend-config-files-common-2.3.3-49.el6sat.noarch.rpm	SHA-256: 824a65acbf2acf97f1fbf25de369f5fab45d1ffcc0e0ec7cde4e657be3d0420f
spacewalk-backend-config-files-tool-2.3.3-49.el6sat.noarch.rpm	SHA-256: 1be2ab4b672269f9f74edf2f9dc64c4651e4b8883c3db58b3e83c30dd3d1f071
spacewalk-backend-iss-2.3.3-49.el6sat.noarch.rpm	SHA-256: 0a50887d5c4653c8ec34e37f0fd4e39d3050f15413927a31a32de42cfffab75b
spacewalk-backend-iss-export-2.3.3-49.el6sat.noarch.rpm	SHA-256: 619c2854ed74e685f488c15f6cadb6f01c1448fe6cda3a93689b986176891fbf
spacewalk-backend-libs-2.3.3-49.el6sat.noarch.rpm	SHA-256: 2a90b44dc3b52d7bc3ec0ec002abd440c3c1f9fa470d341c92b1a86896c4c641
spacewalk-backend-package-push-server-2.3.3-49.el6sat.noarch.rpm	SHA-256: 82a7ac34477d98e125a148d08c0e042c653ff0b909ffff5689276375a9dacdd2
spacewalk-backend-server-2.3.3-49.el6sat.noarch.rpm	SHA-256: e499abccf6b9906641cf94312eb133fe21b60086b976717702647e3aefc1be79
spacewalk-backend-sql-2.3.3-49.el6sat.noarch.rpm	SHA-256: b8505ffe5b39ffa4e8529ce41f6cfd3969e852f40b4d135b9f698b69c0ccc0ae
spacewalk-backend-sql-oracle-2.3.3-49.el6sat.noarch.rpm	SHA-256: b2a218ddc2dd62e10db3c5bbc88b7ad3dcc71fff2088a9ddce5406845609db97
spacewalk-backend-sql-postgresql-2.3.3-49.el6sat.noarch.rpm	SHA-256: 324a779da01a7feaae37d8a60ae09378e72b8891fef79da2fa13e51e8fa09c34
spacewalk-backend-tools-2.3.3-49.el6sat.noarch.rpm	SHA-256: 7df3c1f03eaf8636778991c277cd10b69abb3daf8cb9e4b77c6d3a82cad3597d
spacewalk-backend-xml-export-libs-2.3.3-49.el6sat.noarch.rpm	SHA-256: ee3f477ac2747b1fe8776f79f512e124cd19c72d3b33f8d59357b2764eb7fe95
spacewalk-backend-xmlrpc-2.3.3-49.el6sat.noarch.rpm	SHA-256: 1b60aac6670841b434211fbc62fcf417d62eeb7dea105cb23a38921dec3ebcbe
s390x
spacewalk-backend-2.3.3-49.el6sat.noarch.rpm	SHA-256: 2ed7653fd9286f14ca9f02ce6ae1d4ea4119a8a7497052290372a7a126024c58
spacewalk-backend-app-2.3.3-49.el6sat.noarch.rpm	SHA-256: 247e83483194110ae1e7e427f815bb76e6830b917d8b1d64524dc0493cd9cf6b
spacewalk-backend-applet-2.3.3-49.el6sat.noarch.rpm	SHA-256: 746ee1143a2a85efb51dff923398a94e2b9155ea37516954e7b77932d57d4f9b
spacewalk-backend-config-files-2.3.3-49.el6sat.noarch.rpm	SHA-256: b646793ee28ff4181c0f07be52c527c324275a5d081a14818b8556f3b38eb55d
spacewalk-backend-config-files-common-2.3.3-49.el6sat.noarch.rpm	SHA-256: 824a65acbf2acf97f1fbf25de369f5fab45d1ffcc0e0ec7cde4e657be3d0420f
spacewalk-backend-config-files-tool-2.3.3-49.el6sat.noarch.rpm	SHA-256: 1be2ab4b672269f9f74edf2f9dc64c4651e4b8883c3db58b3e83c30dd3d1f071
spacewalk-backend-iss-2.3.3-49.el6sat.noarch.rpm	SHA-256: 0a50887d5c4653c8ec34e37f0fd4e39d3050f15413927a31a32de42cfffab75b
spacewalk-backend-iss-export-2.3.3-49.el6sat.noarch.rpm	SHA-256: 619c2854ed74e685f488c15f6cadb6f01c1448fe6cda3a93689b986176891fbf
spacewalk-backend-libs-2.3.3-49.el6sat.noarch.rpm	SHA-256: 2a90b44dc3b52d7bc3ec0ec002abd440c3c1f9fa470d341c92b1a86896c4c641
spacewalk-backend-package-push-server-2.3.3-49.el6sat.noarch.rpm	SHA-256: 82a7ac34477d98e125a148d08c0e042c653ff0b909ffff5689276375a9dacdd2
spacewalk-backend-server-2.3.3-49.el6sat.noarch.rpm	SHA-256: e499abccf6b9906641cf94312eb133fe21b60086b976717702647e3aefc1be79
spacewalk-backend-sql-2.3.3-49.el6sat.noarch.rpm	SHA-256: b8505ffe5b39ffa4e8529ce41f6cfd3969e852f40b4d135b9f698b69c0ccc0ae
spacewalk-backend-sql-oracle-2.3.3-49.el6sat.noarch.rpm	SHA-256: b2a218ddc2dd62e10db3c5bbc88b7ad3dcc71fff2088a9ddce5406845609db97
spacewalk-backend-sql-postgresql-2.3.3-49.el6sat.noarch.rpm	SHA-256: 324a779da01a7feaae37d8a60ae09378e72b8891fef79da2fa13e51e8fa09c34
spacewalk-backend-tools-2.3.3-49.el6sat.noarch.rpm	SHA-256: 7df3c1f03eaf8636778991c277cd10b69abb3daf8cb9e4b77c6d3a82cad3597d
spacewalk-backend-xml-export-libs-2.3.3-49.el6sat.noarch.rpm	SHA-256: ee3f477ac2747b1fe8776f79f512e124cd19c72d3b33f8d59357b2764eb7fe95
spacewalk-backend-xmlrpc-2.3.3-49.el6sat.noarch.rpm	SHA-256: 1b60aac6670841b434211fbc62fcf417d62eeb7dea105cb23a38921dec3ebcbe

Red Hat Satellite 5.6

SRPM
spacewalk-backend-2.0.3-45.el6sat.src.rpm	SHA-256: f51ab2939aeb38b939f62390ff10adbb4c33720ecda64a1d239be58c8c9103d4
x86_64
spacewalk-backend-2.0.3-45.el6sat.noarch.rpm	SHA-256: c251bf3f9e8e73be6aa0fa21bf22be5b5465716c96208a4eea6a2640c1942462
spacewalk-backend-app-2.0.3-45.el6sat.noarch.rpm	SHA-256: 0f2b6c66e7601e4863c2080f8b6780136fe57d189c7ce72f5d809f00c29df6b6
spacewalk-backend-applet-2.0.3-45.el6sat.noarch.rpm	SHA-256: 37024a4594fbe95e6bbd9abf1f3bcb0caf2f9100e8ee6ea0575bdc78e6ed9ce1
spacewalk-backend-config-files-2.0.3-45.el6sat.noarch.rpm	SHA-256: dc004d665908445d778c204ab370449fe9adc64a088b01697de433eeaf3fff3c
spacewalk-backend-config-files-common-2.0.3-45.el6sat.noarch.rpm	SHA-256: d90458b22e46ac048914d4c2811c1d2af6cbc1997662dce620bf7c0074f877e2
spacewalk-backend-config-files-tool-2.0.3-45.el6sat.noarch.rpm	SHA-256: 65c5490e0a0cfc2821bd3a062b30fedd36bb83b87c002a1ab084d07bfaefce0f
spacewalk-backend-iss-2.0.3-45.el6sat.noarch.rpm	SHA-256: 3e3390ef0eda55eb3b412137164f22d52a7afd824011030fd8fdefe478d181b7
spacewalk-backend-iss-export-2.0.3-45.el6sat.noarch.rpm	SHA-256: 28ddcc4260d7380e956898b4cd2a028cf97a8a5849e6a731d91b3df7e79746bd
spacewalk-backend-libs-2.0.3-45.el6sat.noarch.rpm	SHA-256: 6d903c327a967859e3c9c99f894701d102b4d3f275e3c084920d2d8276c6aa70
spacewalk-backend-package-push-server-2.0.3-45.el6sat.noarch.rpm	SHA-256: bdc39181e9d9ceb30e3236710aab49c68558e5970625dda9f9902bb1809bb5ab
spacewalk-backend-server-2.0.3-45.el6sat.noarch.rpm	SHA-256: 00464815e0028ffe2aade263293780108be09e304c77335df8dc48a90f8c9f0d
spacewalk-backend-sql-2.0.3-45.el6sat.noarch.rpm	SHA-256: 91cdddd2a16ec5823a4762ba27141ed65c12272860011bac3c0b5dc43b58cd4d
spacewalk-backend-sql-oracle-2.0.3-45.el6sat.noarch.rpm	SHA-256: 18dfdb1ab2f434a254bae6835dea3c6ea3fd8d64a4a6cd2184fffc76cefde30c
spacewalk-backend-sql-postgresql-2.0.3-45.el6sat.noarch.rpm	SHA-256: 481593ecfc5520a702f854420c0fdd11352ecded9ab745a021da3e753d49785c
spacewalk-backend-tools-2.0.3-45.el6sat.noarch.rpm	SHA-256: e14d2792f6602a154ed5703edefad0eda483f142c5fc0a300878c0a43208d6f8
spacewalk-backend-xml-export-libs-2.0.3-45.el6sat.noarch.rpm	SHA-256: 247449a85c6c4b72a89d048cd38826086f215414345ef3edbd8e8a6f64538d22
spacewalk-backend-xmlrpc-2.0.3-45.el6sat.noarch.rpm	SHA-256: aff445b9b908e528383d31ddc6edfc0fdc59c4b01bd9cc7fb273dd104aca0b23
s390x
spacewalk-backend-2.0.3-45.el6sat.noarch.rpm	SHA-256: c251bf3f9e8e73be6aa0fa21bf22be5b5465716c96208a4eea6a2640c1942462
spacewalk-backend-app-2.0.3-45.el6sat.noarch.rpm	SHA-256: 0f2b6c66e7601e4863c2080f8b6780136fe57d189c7ce72f5d809f00c29df6b6
spacewalk-backend-applet-2.0.3-45.el6sat.noarch.rpm	SHA-256: 37024a4594fbe95e6bbd9abf1f3bcb0caf2f9100e8ee6ea0575bdc78e6ed9ce1
spacewalk-backend-config-files-2.0.3-45.el6sat.noarch.rpm	SHA-256: dc004d665908445d778c204ab370449fe9adc64a088b01697de433eeaf3fff3c
spacewalk-backend-config-files-common-2.0.3-45.el6sat.noarch.rpm	SHA-256: d90458b22e46ac048914d4c2811c1d2af6cbc1997662dce620bf7c0074f877e2
spacewalk-backend-config-files-tool-2.0.3-45.el6sat.noarch.rpm	SHA-256: 65c5490e0a0cfc2821bd3a062b30fedd36bb83b87c002a1ab084d07bfaefce0f
spacewalk-backend-iss-2.0.3-45.el6sat.noarch.rpm	SHA-256: 3e3390ef0eda55eb3b412137164f22d52a7afd824011030fd8fdefe478d181b7
spacewalk-backend-iss-export-2.0.3-45.el6sat.noarch.rpm	SHA-256: 28ddcc4260d7380e956898b4cd2a028cf97a8a5849e6a731d91b3df7e79746bd
spacewalk-backend-libs-2.0.3-45.el6sat.noarch.rpm	SHA-256: 6d903c327a967859e3c9c99f894701d102b4d3f275e3c084920d2d8276c6aa70
spacewalk-backend-package-push-server-2.0.3-45.el6sat.noarch.rpm	SHA-256: bdc39181e9d9ceb30e3236710aab49c68558e5970625dda9f9902bb1809bb5ab
spacewalk-backend-server-2.0.3-45.el6sat.noarch.rpm	SHA-256: 00464815e0028ffe2aade263293780108be09e304c77335df8dc48a90f8c9f0d
spacewalk-backend-sql-2.0.3-45.el6sat.noarch.rpm	SHA-256: 91cdddd2a16ec5823a4762ba27141ed65c12272860011bac3c0b5dc43b58cd4d
spacewalk-backend-sql-oracle-2.0.3-45.el6sat.noarch.rpm	SHA-256: 18dfdb1ab2f434a254bae6835dea3c6ea3fd8d64a4a6cd2184fffc76cefde30c
spacewalk-backend-sql-postgresql-2.0.3-45.el6sat.noarch.rpm	SHA-256: 481593ecfc5520a702f854420c0fdd11352ecded9ab745a021da3e753d49785c
spacewalk-backend-tools-2.0.3-45.el6sat.noarch.rpm	SHA-256: e14d2792f6602a154ed5703edefad0eda483f142c5fc0a300878c0a43208d6f8
spacewalk-backend-xml-export-libs-2.0.3-45.el6sat.noarch.rpm	SHA-256: 247449a85c6c4b72a89d048cd38826086f215414345ef3edbd8e8a6f64538d22
spacewalk-backend-xmlrpc-2.0.3-45.el6sat.noarch.rpm	SHA-256: aff445b9b908e528383d31ddc6edfc0fdc59c4b01bd9cc7fb273dd104aca0b23