Synopsis

Moderate: spacewalk-backend security update

Type/Severity

Security Advisory: Moderate

Topic

An update for spacewalk-backend is now available for Red Hat Satellite 5.6 and Red Hat Satellite 5.7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Spacewalk is an Open Source systems management solution that provides system provisioning, configuration and patching capabilities.

Security Fix(es):

• It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py. (CVE-2017-7470)
  

Red Hat would like to thank Bert Stel (SUSE) for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For this update to take effect, Red Hat Satellite must be restarted ("/usr/sbin/rhn-satellite restart").

Affected Products

• Red Hat Satellite 5.7 x86_64
• Red Hat Satellite 5.7 s390x
• Red Hat Satellite 5.6 for RHEL 6 x86_64
• Red Hat Satellite 5.6 for RHEL 6 s390x
• Red Hat Satellite 5.6 for RHEL 5 x86_64
• Red Hat Satellite 5.6 for RHEL 5 s390x

Fixes

• BZ - 1439622 - CVE-2017-7470 spacewalk-backend: spacewalk-channel can be used by non-admin or disabled users for performing administrative tasks

CVEs

• CVE-2017-7470

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Satellite 5.7

SRPM
spacewalk-backend-2.3.3-49.el6sat.src.rpm	SHA-256: cf836ce165d0214946017277a0c29fd47ab767b7222b14570281f6ef48be5733
x86_64
spacewalk-backend-2.3.3-49.el6sat.noarch.rpm	SHA-256: 2ed7653fd9286f14ca9f02ce6ae1d4ea4119a8a7497052290372a7a126024c58
spacewalk-backend-app-2.3.3-49.el6sat.noarch.rpm	SHA-256: 247e83483194110ae1e7e427f815bb76e6830b917d8b1d64524dc0493cd9cf6b
spacewalk-backend-applet-2.3.3-49.el6sat.noarch.rpm	SHA-256: 746ee1143a2a85efb51dff923398a94e2b9155ea37516954e7b77932d57d4f9b
spacewalk-backend-config-files-2.3.3-49.el6sat.noarch.rpm	SHA-256: b646793ee28ff4181c0f07be52c527c324275a5d081a14818b8556f3b38eb55d
spacewalk-backend-config-files-common-2.3.3-49.el6sat.noarch.rpm	SHA-256: 824a65acbf2acf97f1fbf25de369f5fab45d1ffcc0e0ec7cde4e657be3d0420f
spacewalk-backend-config-files-tool-2.3.3-49.el6sat.noarch.rpm	SHA-256: 1be2ab4b672269f9f74edf2f9dc64c4651e4b8883c3db58b3e83c30dd3d1f071
spacewalk-backend-iss-2.3.3-49.el6sat.noarch.rpm	SHA-256: 0a50887d5c4653c8ec34e37f0fd4e39d3050f15413927a31a32de42cfffab75b
spacewalk-backend-iss-export-2.3.3-49.el6sat.noarch.rpm	SHA-256: 619c2854ed74e685f488c15f6cadb6f01c1448fe6cda3a93689b986176891fbf
spacewalk-backend-libs-2.3.3-49.el6sat.noarch.rpm	SHA-256: 2a90b44dc3b52d7bc3ec0ec002abd440c3c1f9fa470d341c92b1a86896c4c641
spacewalk-backend-package-push-server-2.3.3-49.el6sat.noarch.rpm	SHA-256: 82a7ac34477d98e125a148d08c0e042c653ff0b909ffff5689276375a9dacdd2
spacewalk-backend-server-2.3.3-49.el6sat.noarch.rpm	SHA-256: e499abccf6b9906641cf94312eb133fe21b60086b976717702647e3aefc1be79
spacewalk-backend-sql-2.3.3-49.el6sat.noarch.rpm	SHA-256: b8505ffe5b39ffa4e8529ce41f6cfd3969e852f40b4d135b9f698b69c0ccc0ae
spacewalk-backend-sql-oracle-2.3.3-49.el6sat.noarch.rpm	SHA-256: b2a218ddc2dd62e10db3c5bbc88b7ad3dcc71fff2088a9ddce5406845609db97
spacewalk-backend-sql-postgresql-2.3.3-49.el6sat.noarch.rpm	SHA-256: 324a779da01a7feaae37d8a60ae09378e72b8891fef79da2fa13e51e8fa09c34
spacewalk-backend-tools-2.3.3-49.el6sat.noarch.rpm	SHA-256: 7df3c1f03eaf8636778991c277cd10b69abb3daf8cb9e4b77c6d3a82cad3597d
spacewalk-backend-xml-export-libs-2.3.3-49.el6sat.noarch.rpm	SHA-256: ee3f477ac2747b1fe8776f79f512e124cd19c72d3b33f8d59357b2764eb7fe95
spacewalk-backend-xmlrpc-2.3.3-49.el6sat.noarch.rpm	SHA-256: 1b60aac6670841b434211fbc62fcf417d62eeb7dea105cb23a38921dec3ebcbe
s390x
spacewalk-backend-2.3.3-49.el6sat.noarch.rpm	SHA-256: 2ed7653fd9286f14ca9f02ce6ae1d4ea4119a8a7497052290372a7a126024c58
spacewalk-backend-app-2.3.3-49.el6sat.noarch.rpm	SHA-256: 247e83483194110ae1e7e427f815bb76e6830b917d8b1d64524dc0493cd9cf6b
spacewalk-backend-applet-2.3.3-49.el6sat.noarch.rpm	SHA-256: 746ee1143a2a85efb51dff923398a94e2b9155ea37516954e7b77932d57d4f9b
spacewalk-backend-config-files-2.3.3-49.el6sat.noarch.rpm	SHA-256: b646793ee28ff4181c0f07be52c527c324275a5d081a14818b8556f3b38eb55d
spacewalk-backend-config-files-common-2.3.3-49.el6sat.noarch.rpm	SHA-256: 824a65acbf2acf97f1fbf25de369f5fab45d1ffcc0e0ec7cde4e657be3d0420f
spacewalk-backend-config-files-tool-2.3.3-49.el6sat.noarch.rpm	SHA-256: 1be2ab4b672269f9f74edf2f9dc64c4651e4b8883c3db58b3e83c30dd3d1f071
spacewalk-backend-iss-2.3.3-49.el6sat.noarch.rpm	SHA-256: 0a50887d5c4653c8ec34e37f0fd4e39d3050f15413927a31a32de42cfffab75b
spacewalk-backend-iss-export-2.3.3-49.el6sat.noarch.rpm	SHA-256: 619c2854ed74e685f488c15f6cadb6f01c1448fe6cda3a93689b986176891fbf
spacewalk-backend-libs-2.3.3-49.el6sat.noarch.rpm	SHA-256: 2a90b44dc3b52d7bc3ec0ec002abd440c3c1f9fa470d341c92b1a86896c4c641
spacewalk-backend-package-push-server-2.3.3-49.el6sat.noarch.rpm	SHA-256: 82a7ac34477d98e125a148d08c0e042c653ff0b909ffff5689276375a9dacdd2
spacewalk-backend-server-2.3.3-49.el6sat.noarch.rpm	SHA-256: e499abccf6b9906641cf94312eb133fe21b60086b976717702647e3aefc1be79
spacewalk-backend-sql-2.3.3-49.el6sat.noarch.rpm	SHA-256: b8505ffe5b39ffa4e8529ce41f6cfd3969e852f40b4d135b9f698b69c0ccc0ae
spacewalk-backend-sql-oracle-2.3.3-49.el6sat.noarch.rpm	SHA-256: b2a218ddc2dd62e10db3c5bbc88b7ad3dcc71fff2088a9ddce5406845609db97
spacewalk-backend-sql-postgresql-2.3.3-49.el6sat.noarch.rpm	SHA-256: 324a779da01a7feaae37d8a60ae09378e72b8891fef79da2fa13e51e8fa09c34
spacewalk-backend-tools-2.3.3-49.el6sat.noarch.rpm	SHA-256: 7df3c1f03eaf8636778991c277cd10b69abb3daf8cb9e4b77c6d3a82cad3597d
spacewalk-backend-xml-export-libs-2.3.3-49.el6sat.noarch.rpm	SHA-256: ee3f477ac2747b1fe8776f79f512e124cd19c72d3b33f8d59357b2764eb7fe95
spacewalk-backend-xmlrpc-2.3.3-49.el6sat.noarch.rpm	SHA-256: 1b60aac6670841b434211fbc62fcf417d62eeb7dea105cb23a38921dec3ebcbe

Red Hat Satellite 5.6 for RHEL 6

SRPM
spacewalk-backend-2.0.3-45.el6sat.src.rpm	SHA-256: f51ab2939aeb38b939f62390ff10adbb4c33720ecda64a1d239be58c8c9103d4
x86_64
spacewalk-backend-2.0.3-45.el6sat.noarch.rpm	SHA-256: c251bf3f9e8e73be6aa0fa21bf22be5b5465716c96208a4eea6a2640c1942462
spacewalk-backend-app-2.0.3-45.el6sat.noarch.rpm	SHA-256: 0f2b6c66e7601e4863c2080f8b6780136fe57d189c7ce72f5d809f00c29df6b6
spacewalk-backend-applet-2.0.3-45.el6sat.noarch.rpm	SHA-256: 37024a4594fbe95e6bbd9abf1f3bcb0caf2f9100e8ee6ea0575bdc78e6ed9ce1
spacewalk-backend-config-files-2.0.3-45.el6sat.noarch.rpm	SHA-256: dc004d665908445d778c204ab370449fe9adc64a088b01697de433eeaf3fff3c
spacewalk-backend-config-files-common-2.0.3-45.el6sat.noarch.rpm	SHA-256: d90458b22e46ac048914d4c2811c1d2af6cbc1997662dce620bf7c0074f877e2
spacewalk-backend-config-files-tool-2.0.3-45.el6sat.noarch.rpm	SHA-256: 65c5490e0a0cfc2821bd3a062b30fedd36bb83b87c002a1ab084d07bfaefce0f
spacewalk-backend-iss-2.0.3-45.el6sat.noarch.rpm	SHA-256: 3e3390ef0eda55eb3b412137164f22d52a7afd824011030fd8fdefe478d181b7
spacewalk-backend-iss-export-2.0.3-45.el6sat.noarch.rpm	SHA-256: 28ddcc4260d7380e956898b4cd2a028cf97a8a5849e6a731d91b3df7e79746bd
spacewalk-backend-libs-2.0.3-45.el6sat.noarch.rpm	SHA-256: 6d903c327a967859e3c9c99f894701d102b4d3f275e3c084920d2d8276c6aa70
spacewalk-backend-package-push-server-2.0.3-45.el6sat.noarch.rpm	SHA-256: bdc39181e9d9ceb30e3236710aab49c68558e5970625dda9f9902bb1809bb5ab
spacewalk-backend-server-2.0.3-45.el6sat.noarch.rpm	SHA-256: 00464815e0028ffe2aade263293780108be09e304c77335df8dc48a90f8c9f0d
spacewalk-backend-sql-2.0.3-45.el6sat.noarch.rpm	SHA-256: 91cdddd2a16ec5823a4762ba27141ed65c12272860011bac3c0b5dc43b58cd4d
spacewalk-backend-sql-oracle-2.0.3-45.el6sat.noarch.rpm	SHA-256: 18dfdb1ab2f434a254bae6835dea3c6ea3fd8d64a4a6cd2184fffc76cefde30c
spacewalk-backend-sql-postgresql-2.0.3-45.el6sat.noarch.rpm	SHA-256: 481593ecfc5520a702f854420c0fdd11352ecded9ab745a021da3e753d49785c
spacewalk-backend-tools-2.0.3-45.el6sat.noarch.rpm	SHA-256: e14d2792f6602a154ed5703edefad0eda483f142c5fc0a300878c0a43208d6f8
spacewalk-backend-xml-export-libs-2.0.3-45.el6sat.noarch.rpm	SHA-256: 247449a85c6c4b72a89d048cd38826086f215414345ef3edbd8e8a6f64538d22
spacewalk-backend-xmlrpc-2.0.3-45.el6sat.noarch.rpm	SHA-256: aff445b9b908e528383d31ddc6edfc0fdc59c4b01bd9cc7fb273dd104aca0b23
s390x
spacewalk-backend-2.0.3-45.el6sat.noarch.rpm	SHA-256: c251bf3f9e8e73be6aa0fa21bf22be5b5465716c96208a4eea6a2640c1942462
spacewalk-backend-app-2.0.3-45.el6sat.noarch.rpm	SHA-256: 0f2b6c66e7601e4863c2080f8b6780136fe57d189c7ce72f5d809f00c29df6b6
spacewalk-backend-applet-2.0.3-45.el6sat.noarch.rpm	SHA-256: 37024a4594fbe95e6bbd9abf1f3bcb0caf2f9100e8ee6ea0575bdc78e6ed9ce1
spacewalk-backend-config-files-2.0.3-45.el6sat.noarch.rpm	SHA-256: dc004d665908445d778c204ab370449fe9adc64a088b01697de433eeaf3fff3c
spacewalk-backend-config-files-common-2.0.3-45.el6sat.noarch.rpm	SHA-256: d90458b22e46ac048914d4c2811c1d2af6cbc1997662dce620bf7c0074f877e2
spacewalk-backend-config-files-tool-2.0.3-45.el6sat.noarch.rpm	SHA-256: 65c5490e0a0cfc2821bd3a062b30fedd36bb83b87c002a1ab084d07bfaefce0f
spacewalk-backend-iss-2.0.3-45.el6sat.noarch.rpm	SHA-256: 3e3390ef0eda55eb3b412137164f22d52a7afd824011030fd8fdefe478d181b7
spacewalk-backend-iss-export-2.0.3-45.el6sat.noarch.rpm	SHA-256: 28ddcc4260d7380e956898b4cd2a028cf97a8a5849e6a731d91b3df7e79746bd
spacewalk-backend-libs-2.0.3-45.el6sat.noarch.rpm	SHA-256: 6d903c327a967859e3c9c99f894701d102b4d3f275e3c084920d2d8276c6aa70
spacewalk-backend-package-push-server-2.0.3-45.el6sat.noarch.rpm	SHA-256: bdc39181e9d9ceb30e3236710aab49c68558e5970625dda9f9902bb1809bb5ab
spacewalk-backend-server-2.0.3-45.el6sat.noarch.rpm	SHA-256: 00464815e0028ffe2aade263293780108be09e304c77335df8dc48a90f8c9f0d
spacewalk-backend-sql-2.0.3-45.el6sat.noarch.rpm	SHA-256: 91cdddd2a16ec5823a4762ba27141ed65c12272860011bac3c0b5dc43b58cd4d
spacewalk-backend-sql-oracle-2.0.3-45.el6sat.noarch.rpm	SHA-256: 18dfdb1ab2f434a254bae6835dea3c6ea3fd8d64a4a6cd2184fffc76cefde30c
spacewalk-backend-sql-postgresql-2.0.3-45.el6sat.noarch.rpm	SHA-256: 481593ecfc5520a702f854420c0fdd11352ecded9ab745a021da3e753d49785c
spacewalk-backend-tools-2.0.3-45.el6sat.noarch.rpm	SHA-256: e14d2792f6602a154ed5703edefad0eda483f142c5fc0a300878c0a43208d6f8
spacewalk-backend-xml-export-libs-2.0.3-45.el6sat.noarch.rpm	SHA-256: 247449a85c6c4b72a89d048cd38826086f215414345ef3edbd8e8a6f64538d22
spacewalk-backend-xmlrpc-2.0.3-45.el6sat.noarch.rpm	SHA-256: aff445b9b908e528383d31ddc6edfc0fdc59c4b01bd9cc7fb273dd104aca0b23

Red Hat Satellite 5.6 for RHEL 5

SRPM
spacewalk-backend-2.0.3-45.el5sat.src.rpm	SHA-256: d94a011d3128fe3d6e4aa45238f44267086ddc751f5e32f7676d35a368349415
x86_64
spacewalk-backend-2.0.3-45.el5sat.noarch.rpm	SHA-256: c02d59cae9a38482f21204eed232b7ebd824ede92df15fc5d6ac7e62fdab7e34
spacewalk-backend-app-2.0.3-45.el5sat.noarch.rpm	SHA-256: c9da57f78cbdc1093cf8d3641f1cc712c0ea210958a2dc0032ac3003d1916c7c
spacewalk-backend-applet-2.0.3-45.el5sat.noarch.rpm	SHA-256: 2c4eb1b4b679d654925c8d3373a5981e2e1048911a6dffd6c18b23ad159630d8
spacewalk-backend-config-files-2.0.3-45.el5sat.noarch.rpm	SHA-256: a1409996c79a156ed339ac19e60e98c88e04564016452d6dbb655463aa572d6a
spacewalk-backend-config-files-common-2.0.3-45.el5sat.noarch.rpm	SHA-256: 77aabb4b53bdf381cd8c76e8e82ea148c5fdd5bd558bdd95c5f88d4b86b5e54d
spacewalk-backend-config-files-tool-2.0.3-45.el5sat.noarch.rpm	SHA-256: d308563718a3e5570de089bb9831dfd16d3776a71f3d38befe31c0dfa3fbb137
spacewalk-backend-iss-2.0.3-45.el5sat.noarch.rpm	SHA-256: d4bb229220b58a9309c4c7812c5992efd1d30432f44badd0e7be505de5af11e8
spacewalk-backend-iss-export-2.0.3-45.el5sat.noarch.rpm	SHA-256: 590c50def8254c3c7e3af0d02a52732bdecb3aa710821741a29724bf68b4ff11
spacewalk-backend-libs-2.0.3-45.el5sat.noarch.rpm	SHA-256: 62c8a9661d45bc126c38831ae26f741cf7d958d346f7222a7f5eb13a6c62be99
spacewalk-backend-package-push-server-2.0.3-45.el5sat.noarch.rpm	SHA-256: f1c7d82c744589d9afbc9e1127697de1af1bade1eb8865b641b0810729549bc9
spacewalk-backend-server-2.0.3-45.el5sat.noarch.rpm	SHA-256: b6062de6e89319abe93083b1a94a8d94edee7c18ffb7b7fae656a0a686c11f5f
spacewalk-backend-sql-2.0.3-45.el5sat.noarch.rpm	SHA-256: 526ed7a286756c630efbaa7e0cafc3b454881077e993eea4a8a1239ebfc06e52
spacewalk-backend-sql-oracle-2.0.3-45.el5sat.noarch.rpm	SHA-256: 9c1b7692744903d149573f481709da42295792382522a2887099c362b1006487
spacewalk-backend-sql-postgresql-2.0.3-45.el5sat.noarch.rpm	SHA-256: 3fa6b28c8b5d52a91e75da40619779eff8a2b5e82c7da124edf532282a64813b
spacewalk-backend-tools-2.0.3-45.el5sat.noarch.rpm	SHA-256: 6ebb6ead47203bd207ac0d3156ca88e86a11335ba36b80f62f9bef82fdd7c1c1
spacewalk-backend-xml-export-libs-2.0.3-45.el5sat.noarch.rpm	SHA-256: dce840b32762d0d1c60e328941e6bfc995b68e62514fc52d0705d7d1bc80849a
spacewalk-backend-xmlrpc-2.0.3-45.el5sat.noarch.rpm	SHA-256: 1832bfc27f3ca8a2c3934d480f66fcc3cc95f68827ce6be848a6adac03c41264
s390x
spacewalk-backend-2.0.3-45.el5sat.noarch.rpm	SHA-256: c02d59cae9a38482f21204eed232b7ebd824ede92df15fc5d6ac7e62fdab7e34
spacewalk-backend-app-2.0.3-45.el5sat.noarch.rpm	SHA-256: c9da57f78cbdc1093cf8d3641f1cc712c0ea210958a2dc0032ac3003d1916c7c
spacewalk-backend-applet-2.0.3-45.el5sat.noarch.rpm	SHA-256: 2c4eb1b4b679d654925c8d3373a5981e2e1048911a6dffd6c18b23ad159630d8
spacewalk-backend-config-files-2.0.3-45.el5sat.noarch.rpm	SHA-256: a1409996c79a156ed339ac19e60e98c88e04564016452d6dbb655463aa572d6a
spacewalk-backend-config-files-common-2.0.3-45.el5sat.noarch.rpm	SHA-256: 77aabb4b53bdf381cd8c76e8e82ea148c5fdd5bd558bdd95c5f88d4b86b5e54d
spacewalk-backend-config-files-tool-2.0.3-45.el5sat.noarch.rpm	SHA-256: d308563718a3e5570de089bb9831dfd16d3776a71f3d38befe31c0dfa3fbb137
spacewalk-backend-iss-2.0.3-45.el5sat.noarch.rpm	SHA-256: d4bb229220b58a9309c4c7812c5992efd1d30432f44badd0e7be505de5af11e8
spacewalk-backend-iss-export-2.0.3-45.el5sat.noarch.rpm	SHA-256: 590c50def8254c3c7e3af0d02a52732bdecb3aa710821741a29724bf68b4ff11
spacewalk-backend-libs-2.0.3-45.el5sat.noarch.rpm	SHA-256: 62c8a9661d45bc126c38831ae26f741cf7d958d346f7222a7f5eb13a6c62be99
spacewalk-backend-package-push-server-2.0.3-45.el5sat.noarch.rpm	SHA-256: f1c7d82c744589d9afbc9e1127697de1af1bade1eb8865b641b0810729549bc9
spacewalk-backend-server-2.0.3-45.el5sat.noarch.rpm	SHA-256: b6062de6e89319abe93083b1a94a8d94edee7c18ffb7b7fae656a0a686c11f5f
spacewalk-backend-sql-2.0.3-45.el5sat.noarch.rpm	SHA-256: 526ed7a286756c630efbaa7e0cafc3b454881077e993eea4a8a1239ebfc06e52
spacewalk-backend-sql-oracle-2.0.3-45.el5sat.noarch.rpm	SHA-256: 9c1b7692744903d149573f481709da42295792382522a2887099c362b1006487
spacewalk-backend-sql-postgresql-2.0.3-45.el5sat.noarch.rpm	SHA-256: 3fa6b28c8b5d52a91e75da40619779eff8a2b5e82c7da124edf532282a64813b
spacewalk-backend-tools-2.0.3-45.el5sat.noarch.rpm	SHA-256: 6ebb6ead47203bd207ac0d3156ca88e86a11335ba36b80f62f9bef82fdd7c1c1
spacewalk-backend-xml-export-libs-2.0.3-45.el5sat.noarch.rpm	SHA-256: dce840b32762d0d1c60e328941e6bfc995b68e62514fc52d0705d7d1bc80849a
spacewalk-backend-xmlrpc-2.0.3-45.el5sat.noarch.rpm	SHA-256: 1832bfc27f3ca8a2c3934d480f66fcc3cc95f68827ce6be848a6adac03c41264