Red Hat Enterprise Linux 7 update for fence-agents



Published: 2020-11-13
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-11078
CWE-ID CWE-93
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Red Hat Enterprise Linux Resilient Storage for x86_64
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Power, little endian
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Power, big endian
Operating systems & Components / Operating system

Red Hat Enterprise Linux for IBM z Systems
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Scientific Computing
Operating systems & Components / Operating system

Red Hat Enterprise Linux Workstation
Operating systems & Components / Operating system

Red Hat Enterprise Linux Server
Operating systems & Components / Operating system

fence-agents (Red Hat package)
Operating systems & Components / Operating system package or component

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) CRLF injection

EUVDB-ID: #VU28245

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-11078

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform CRLF injection attacks.

The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker controlling unescaped part of uri for "httplib2.Http.request()" can change request headers and body, send additional hidden requests to same server.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Resilient Storage for x86_64: 7

Red Hat Enterprise Linux for Power, little endian: 7

Red Hat Enterprise Linux for Power, big endian: 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Workstation: 7

Red Hat Enterprise Linux Server: 7

fence-agents (Red Hat package): before 4.2.1-41.el7_9.2


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:5003

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###