Foreman Authentication Bypass Vulnerability
CVE-2024-7012

9.8CRITICAL

Key Information:

Status: Red Hat Satellite 6.13 For Rhel 8; Red Hat Satellite 6.14 For Rhel 8; Red Hat Satellite 6.15 For Rhel 8
Vendor: CVE Published:; 4 September 2024

What is CVE-2024-7012?

An authentication bypass vulnerability has been detected in Foreman when integrated with External Authentication due to misconfiguration in the puppet-foreman settings. This flaw is linked to Apache's mod_proxy failing to adequately unset headers, specifically related to limitations on underscores in HTTP headers. As a result, an attacker could exploit this issue through a malformed header, leading to the possibility of unauthorized users obtaining administrative access. This vulnerability is present in all active deployments of Red Hat Satellite versions 6.13, 6.14, and 6.15.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch