CVE-2023-4320
Assigner: redhat
Published: 2023-12-18T13:43:07.747Z
State: PUBLISHED
title: Satellite: arithmetic overflow in satellite
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
version: 3.1
format: CVSS
descriptions: value: An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.
affected: vendor: Red Hat
product: Red Hat Satellite 6.15 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: foreman
defaultStatus: affected
versions: version: 0:3.9.1.6-1.el8sat
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:satellite_utils:6.15::el8
cpe:/a:redhat:satellite:6.15::el8
cpe:/a:redhat:satellite_maintenance:6.15::el8
cpe:/a:redhat:satellite_capsule:6.15::el8
vendor: Red Hat
product: Red Hat Satellite 6.15 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: foreman
defaultStatus: affected
versions: version: 0:3.9.1.6-1.el8sat
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:satellite_utils:6.15::el8
cpe:/a:redhat:satellite:6.15::el8
cpe:/a:redhat:satellite_maintenance:6.15::el8
cpe:/a:redhat:satellite_capsule:6.15::el8
datePublic: 2023-08-14T09:03:00+00:00
problemTypes: descriptions: cweId: CWE-613
description: Insufficient Session Expiration
type: CWE
x_redhatCweChain: CWE-613: Insufficient Session Expiration
timeline: time: 2023-08-14T00:00:00+00:00
value: Reported to Red Hat.
time: 2023-08-14T09:03:00+00:00
value: Made public.