{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-11610.json" } ], "title": "supervisor: Command injection via malicious XML-RPC request", "tracking": { "current_release_date": "2026-05-13T01:13:28+00:00", "generator": { "date": "2026-05-13T01:13:28+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.7.9" } }, "id": "CVE-2017-11610", "initial_release_date": "2017-07-24T00:00:00+00:00", "revision_history": [ { "date": "2017-07-24T00:00:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-05-13T00:45:33+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-05-13T01:13:28+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Ceph Storage 1.3", "product": { "name": "Red Hat Ceph Storage 1.3", "product_id": "red_hat_ceph_storage_1.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:ceph_storage:1.3" } } } ], "category": "product_family", "name": "Red Hat Ceph Storage 1.3" }, { "branches": [ { "category": "product_name", "name": "Red Hat Ceph Storage 2", "product": { "name": "Red Hat Ceph Storage 2", "product_id": "red_hat_ceph_storage_2", "product_identification_helper": { "cpe": "cpe:/a:redhat:ceph_storage:2" } } } ], "category": "product_family", "name": "Red Hat Ceph Storage 2" }, { "branches": [ { "category": "product_name", "name": "Red Hat Mobile Application Platform 4", "product": { "name": "Red Hat Mobile Application Platform 4", "product_id": "red_hat_mobile_application_platform_4", "product_identification_helper": { "cpe": "cpe:/a:redhat:mobile_application_platform:4" } } } ], "category": "product_family", "name": "Red Hat Mobile Application Platform 4" }, { "branches": [ { "category": "product_name", "name": "CloudForms Management Engine 5.8", "product": { "name": "CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.8::el7" } } } ], "category": "product_family", "name": "Red Hat CloudForms" }, { "category": "product_version", "name": "supervisor.src", "product": { "name": "supervisor.src", "product_id": "supervisor.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/supervisor?arch=src" } } }, { "category": "product_version", "name": "nagios.src", "product": { "name": "nagios.src", "product_id": "nagios.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nagios?arch=src" } } }, { "branches": [ { "category": "product_version", "name": "ansible-tower-server-0:3.1.5-1.el7at.x86_64", "product": { "name": "ansible-tower-server-0:3.1.5-1.el7at.x86_64", "product_id": "ansible-tower-server-0:3.1.5-1.el7at.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ansible-tower-server@3.1.5-1.el7at?arch=x86_64" } } }, { "category": "product_version", "name": "ansible-tower-setup-0:3.1.5-1.el7at.x86_64", "product": { "name": "ansible-tower-setup-0:3.1.5-1.el7at.x86_64", "product_id": "ansible-tower-setup-0:3.1.5-1.el7at.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ansible-tower-setup@3.1.5-1.el7at?arch=x86_64" } } }, { "category": "product_version", "name": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64", "product": { "name": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64", "product_id": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-ruby23-rubygem-nokogiri@1.8.1-2.el7cf?arch=x86_64" } } }, { "category": "product_version", "name": "rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64", "product": { "name": "rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64", "product_id": "rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-ruby23-rubygem-nokogiri-debuginfo@1.8.1-2.el7cf?arch=x86_64" } } }, { "category": "product_version", "name": "rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64", "product": { "name": "rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64", "product_id": "rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-ruby23-rubygem-nokogiri-doc@1.8.1-2.el7cf?arch=x86_64" } } }, { "category": "product_version", "name": "cfme-0:5.8.2.3-1.el7cf.x86_64", "product": { "name": "cfme-0:5.8.2.3-1.el7cf.x86_64", "product_id": "cfme-0:5.8.2.3-1.el7cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cfme@5.8.2.3-1.el7cf?arch=x86_64" } } }, { "category": "product_version", "name": "cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "product": { "name": "cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "product_id": "cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cfme-debuginfo@5.8.2.3-1.el7cf?arch=x86_64" } } }, { "category": "product_version", "name": "cfme-appliance-0:5.8.2.3-1.el7cf.x86_64", "product": { "name": "cfme-appliance-0:5.8.2.3-1.el7cf.x86_64", "product_id": "cfme-appliance-0:5.8.2.3-1.el7cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cfme-appliance@5.8.2.3-1.el7cf?arch=x86_64" } } }, { "category": "product_version", "name": "cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "product": { "name": "cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "product_id": "cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cfme-appliance-debuginfo@5.8.2.3-1.el7cf?arch=x86_64" } } }, { "category": "product_version", "name": "cfme-gemset-0:5.8.2.3-1.el7cf.x86_64", "product": { "name": "cfme-gemset-0:5.8.2.3-1.el7cf.x86_64", "product_id": "cfme-gemset-0:5.8.2.3-1.el7cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cfme-gemset@5.8.2.3-1.el7cf?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "supervisor-0:3.1.4-1.el7.src", "product": { "name": "supervisor-0:3.1.4-1.el7.src", "product_id": "supervisor-0:3.1.4-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/supervisor@3.1.4-1.el7?arch=src" } } }, { "category": "product_version", "name": "rabbitmq-server-0:3.6.9-1.el7at.src", "product": { "name": "rabbitmq-server-0:3.6.9-1.el7at.src", "product_id": "rabbitmq-server-0:3.6.9-1.el7at.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rabbitmq-server@3.6.9-1.el7at?arch=src" } } }, { "category": "product_version", "name": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src", "product": { "name": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src", "product_id": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-ruby23-rubygem-nokogiri@1.8.1-2.el7cf?arch=src" } } }, { "category": "product_version", "name": "cfme-0:5.8.2.3-1.el7cf.src", "product": { "name": "cfme-0:5.8.2.3-1.el7cf.src", "product_id": "cfme-0:5.8.2.3-1.el7cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/cfme@5.8.2.3-1.el7cf?arch=src" } } }, { "category": "product_version", "name": "cfme-appliance-0:5.8.2.3-1.el7cf.src", "product": { "name": "cfme-appliance-0:5.8.2.3-1.el7cf.src", "product_id": "cfme-appliance-0:5.8.2.3-1.el7cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/cfme-appliance@5.8.2.3-1.el7cf?arch=src" } } }, { "category": "product_version", "name": "cfme-gemset-0:5.8.2.3-1.el7cf.src", "product": { "name": "cfme-gemset-0:5.8.2.3-1.el7cf.src", "product_id": "cfme-gemset-0:5.8.2.3-1.el7cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/cfme-gemset@5.8.2.3-1.el7cf?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "supervisor-0:3.1.4-1.el7.noarch", "product": { "name": "supervisor-0:3.1.4-1.el7.noarch", "product_id": "supervisor-0:3.1.4-1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/supervisor@3.1.4-1.el7?arch=noarch" } } }, { "category": "product_version", "name": "rabbitmq-server-0:3.6.9-1.el7at.noarch", "product": { "name": "rabbitmq-server-0:3.6.9-1.el7at.noarch", "product_id": "rabbitmq-server-0:3.6.9-1.el7at.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rabbitmq-server@3.6.9-1.el7at?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-server-0:3.1.5-1.el7at.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:ansible-tower-server-0:3.1.5-1.el7at.x86_64" }, "product_reference": "ansible-tower-server-0:3.1.5-1.el7at.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-setup-0:3.1.5-1.el7at.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:ansible-tower-setup-0:3.1.5-1.el7at.x86_64" }, "product_reference": "ansible-tower-setup-0:3.1.5-1.el7at.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "cfme-0:5.8.2.3-1.el7cf.src as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.src" }, "product_reference": "cfme-0:5.8.2.3-1.el7cf.src", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "cfme-0:5.8.2.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.x86_64" }, "product_reference": "cfme-0:5.8.2.3-1.el7cf.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "cfme-appliance-0:5.8.2.3-1.el7cf.src as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.src" }, "product_reference": "cfme-appliance-0:5.8.2.3-1.el7cf.src", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "cfme-appliance-0:5.8.2.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.x86_64" }, "product_reference": "cfme-appliance-0:5.8.2.3-1.el7cf.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64" }, "product_reference": "cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64" }, "product_reference": "cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "cfme-gemset-0:5.8.2.3-1.el7cf.src as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.src" }, "product_reference": "cfme-gemset-0:5.8.2.3-1.el7cf.src", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "cfme-gemset-0:5.8.2.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.x86_64" }, "product_reference": "cfme-gemset-0:5.8.2.3-1.el7cf.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "rabbitmq-server-0:3.6.9-1.el7at.noarch as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.noarch" }, "product_reference": "rabbitmq-server-0:3.6.9-1.el7at.noarch", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "rabbitmq-server-0:3.6.9-1.el7at.src as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.src" }, "product_reference": "rabbitmq-server-0:3.6.9-1.el7at.src", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src" }, "product_reference": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64" }, "product_reference": "rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64" }, "product_reference": "rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64 as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64" }, "product_reference": "rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "supervisor-0:3.1.4-1.el7.noarch as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.noarch" }, "product_reference": "supervisor-0:3.1.4-1.el7.noarch", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "supervisor-0:3.1.4-1.el7.src as a component of CloudForms Management Engine 5.8", "product_id": "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.src" }, "product_reference": "supervisor-0:3.1.4-1.el7.src", "relates_to_product_reference": "7Server-RH7-CFME-5.8" }, { "category": "default_component_of", "full_product_name": { "name": "supervisor.src as a component of Red Hat Ceph Storage 1.3", "product_id": "red_hat_ceph_storage_1.3:supervisor.src" }, "product_reference": "supervisor.src", "relates_to_product_reference": "red_hat_ceph_storage_1.3" }, { "category": "default_component_of", "full_product_name": { "name": "supervisor.src as a component of Red Hat Ceph Storage 2", "product_id": "red_hat_ceph_storage_2:supervisor.src" }, "product_reference": "supervisor.src", "relates_to_product_reference": "red_hat_ceph_storage_2" }, { "category": "default_component_of", "full_product_name": { "name": "nagios.src as a component of Red Hat Mobile Application Platform 4", "product_id": "red_hat_mobile_application_platform_4:nagios.src" }, "product_reference": "nagios.src", "relates_to_product_reference": "red_hat_mobile_application_platform_4" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-11610", "cwe": { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')" }, "discovery_date": "2017-07-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "red_hat_mobile_application_platform_4:nagios.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1476143" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the XML-RPC interface in supervisord. When processing malformed commands, an attacker can cause arbitrary shell commands to be executed on the server as the same user as supervisord. Exploitation requires the attacker to first be authenticated to the supervisord service.", "title": "Vulnerability description" }, { "category": "summary", "text": "supervisor: Command injection via malicious XML-RPC request", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-CFME-5.8:ansible-tower-server-0:3.1.5-1.el7at.x86_64", "7Server-RH7-CFME-5.8:ansible-tower-setup-0:3.1.5-1.el7at.x86_64", "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.noarch", "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.src", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.noarch", "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.src" ], "known_affected": [ "red_hat_ceph_storage_1.3:supervisor.src", "red_hat_ceph_storage_2:supervisor.src" ], "known_not_affected": [ "red_hat_mobile_application_platform_4:nagios.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-11610" }, { "category": "external", "summary": "RHBZ#1476143", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1476143" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-11610", "url": "https://www.cve.org/CVERecord?id=CVE-2017-11610" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-11610", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11610" } ], "release_date": "2017-07-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2017-10-24T00:15:49+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-CFME-5.8:ansible-tower-server-0:3.1.5-1.el7at.x86_64", "7Server-RH7-CFME-5.8:ansible-tower-setup-0:3.1.5-1.el7at.x86_64", "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.noarch", "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.src", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.noarch", "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.src" ], "url": "https://access.redhat.com/errata/RHSA-2017:3005" }, { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "red_hat_ceph_storage_1.3:supervisor.src", "red_hat_ceph_storage_2:supervisor.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-RH7-CFME-5.8:ansible-tower-server-0:3.1.5-1.el7at.x86_64", "7Server-RH7-CFME-5.8:ansible-tower-setup-0:3.1.5-1.el7at.x86_64", "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.noarch", "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.src", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.noarch", "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.src", "red_hat_ceph_storage_1.3:supervisor.src", "red_hat_ceph_storage_2:supervisor.src", "red_hat_mobile_application_platform_4:nagios.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "7Server-RH7-CFME-5.8:ansible-tower-server-0:3.1.5-1.el7at.x86_64", "7Server-RH7-CFME-5.8:ansible-tower-setup-0:3.1.5-1.el7at.x86_64", "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-appliance-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-appliance-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-debuginfo-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.src", "7Server-RH7-CFME-5.8:cfme-gemset-0:5.8.2.3-1.el7cf.x86_64", "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.noarch", "7Server-RH7-CFME-5.8:rabbitmq-server-0:3.6.9-1.el7at.src", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.src", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-debuginfo-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:rh-ruby23-rubygem-nokogiri-doc-0:1.8.1-2.el7cf.x86_64", "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.noarch", "7Server-RH7-CFME-5.8:supervisor-0:3.1.4-1.el7.src", "red_hat_ceph_storage_1.3:supervisor.src", "red_hat_ceph_storage_2:supervisor.src", "red_hat_mobile_application_platform_4:nagios.src" ] } ], "title": "supervisor: Command injection via malicious XML-RPC request" } ] }