theforeman hammer cli vulnerabilities

Latest theforeman hammer cli CVEs

Newest publication first

1. CVE-2014-0241 rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable

   Published 2019-12-13

   Medium·CVSS 5.5 EPSS 0.31%

   rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable

2. CVE-2017-2667 hammer_cli_foreman Improper Certificate Validation vulnerability

   Published 2018-03-12

   High·CVSS 8.1 EPSS 0.69% PoC

   Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.