CVE-2014-3691 – foreman-proxy: failure to verify SSL certificates

https://notcve.org/view.php?id=CVE-2014-3691

Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate. Smart Proxy (también conocido como Smart-Proxy y foreman-proxy) en Foreman en versiones anteriores a 1.5.4 y 1.6.x en versiones anteriores a 1.6.2 no valida certificados SSL, lo que permite a atacantes remotos eludir autenticación intencionada y ejecutar peticiones API arbitrarias a través de una petición sin un certificado. It was discovered that foreman-proxy, when running in SSL-secured mode, did not correctly verify SSL client certificates. This could permit any client with access to the API to make requests and perform actions otherwise restricted. • http://projects.theforeman.org/issues/7822 http://rhn.redhat.com/errata/RHSA-2015-0287.html http://rhn.redhat.com/errata/RHSA-2015-0288.html https://github.com/theforeman/smart-proxy/pull/217 https://groups.google.com/forum/#%21topic/foreman-announce/jXC5ixybjqo https://access.redhat.com/security/cve/CVE-2014-3691 https://bugzilla.redhat.com/show_bug.cgi?id=1150879 • CWE-295: Improper Certificate Validation CWE-310: Cryptographic Issues •