CVE-2017-2667 hammer_cli_foreman Improper Certificate Validation vulnerability
HighCVSS 8.1
EPSS 0.69%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems hammer_cli_foreman(RubyGems) | < 0.10.0 | 0.10.0 |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.10 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.11 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.12 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.13 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.14 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.15 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.16 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.17 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.18 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.4 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.5 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.6 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.7 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.8 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.0.9 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.1.0 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.1.1 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.1.2 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.1.3 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.1.4 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.2.0 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.3.0 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.4.0 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.5.0 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems hammer_cli_foreman(RubyGems) | = 0.5.1 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.6.0 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.6.1 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.6.2 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.7.0 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.8.0 | No fix listed |
| rubygems hammer_cli_foreman(RubyGems) | = 0.9.0 | No fix listed |
| theforeman hammer cli | < 0.10.0 | 0.10.0 |
| redhat satellite | = 6.3 | No fix listed |
| redhat satellite capsule | = 6.3 | No fix listed |
| Foreman Hammer CLI | = 0.10.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2018:0336 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- projects.theforeman.org issue-tracking vendor-advisory
- github.com exploit
- web.archive.org
- 97153 broken-link third-party-advisory vdb-entry
- github.com
- github.com product