Pulpcore Authentication Bypass Vulnerability Affects Satellite Deployments

CVE-2024-7923

Summary

An authentication bypass vulnerability has been identified in Pulpcore, particularly affecting deployments running with Gunicorn versions prior to 22.0. This vulnerability is caused by the puppet-pulpcore configuration and Apache's mod_proxy failing to properly unset headers, which restricts underscores in HTTP headers. As a result, unauthorized users can exploit this flaw to gain administrative access to systems. The issue impacts all active Satellite deployments (versions 6.13, 6.14, and 6.15) that utilize Pulpcore version 3.0 and above. Organizations using these systems are strongly advised to review their configurations and implement necessary security measures.

References