Deserialization of Untrusted Data in Discourse - CVE-2022-32224

Vulnerability identifier: #VU65868

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-32224

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in columns in active records. A remote privileged user write access to the database (e.g. via the restore pipeline) can create a specially crafted column and execute arbitrary code on the system during backup restoration.

Discourse
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Satellite
rubygem-smart_proxy_container_gateway (Red Hat package)
python-pulp-container (Red Hat package)
rubygem-foreman_webhooks (Red Hat package)
satellite-clone (Red Hat package)
foreman (Red Hat package)
python-pulp-rpm (Red Hat package)
python-pulpcore (Red Hat package)
candlepin (Red Hat package)
rubygem-katello (Red Hat package)
rubygem-activesupport (Red Hat package)
rubygem-activemodel (Red Hat package)
rubygem-railties (Red Hat package)
rubygem-rails (Red Hat package)
rubygem-activestorage (Red Hat package)
rubygem-activerecord (Red Hat package)
rubygem-activejob (Red Hat package)
rubygem-actionview (Red Hat package)
rubygem-actiontext (Red Hat package)
rubygem-actionpack (Red Hat package)
rubygem-actionmailer (Red Hat package)
rubygem-actionmailbox (Red Hat package)
rubygem-actioncable (Red Hat package)
rubygem-foreman_rh_cloud (Red Hat package)
satellite (Red Hat package)

Install updates from vendor's website.

Discourse - addressed in versions 2.8.6, 2.9.0 beta7
Red Hat Satellite - addressed in versions 6.11.5, 6.12.1, 6.13
rubygem-smart_proxy_container_gateway (Red Hat package) - update to 1.0.7-1.el8sat
python-pulp-container (Red Hat package) - update to 2.10.10-1.el8pc
rubygem-foreman_webhooks (Red Hat package) - update to 3.0.5-1.1.el8sat
satellite-clone (Red Hat package) - update to 3.2.0-2.el8sat
foreman (Red Hat package) - update to 3.3.0.18-1.el8sat
python-pulp-rpm (Red Hat package) - update to 3.18.9-1.el8pc
python-pulpcore (Red Hat package) - update to 3.18.11-1.el8pc
candlepin (Red Hat package) - update to 4.1.18-1.el8sat
rubygem-katello (Red Hat package) - update to 4.5.0.22-1.el8sat
rubygem-activesupport (Red Hat package) - update to 6.0.6-1.el8sat
rubygem-activemodel (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-railties (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-rails (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-activestorage (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-activerecord (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-activejob (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-actionview (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-actiontext (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-actionpack (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-actionmailer (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-actionmailbox (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-actioncable (Red Hat package) - update to 6.0.6-2.el8sat
rubygem-foreman_rh_cloud (Red Hat package) - update to 6.0.44-1.el8sat
satellite (Red Hat package) - update to 6.12.1-1.el8sat

• https://github.com/discourse/discourse/security/advisories/GHSA-5v84-cg7p-ghvx

• Remote code execution in Discourse for Ruby
• Multiple vulnerabilities in Red Hat Satellite 6.12
• Multiple vulnerabilities in Red Hat Satellite 6.13
• Red Hat Satellite 6.11 update for Discourse
• Gentoo update for Ruby on Rails