CVE-2019-10136

MEDIUM

Red Hat Satellite and Spacewalk < 2.9 - Authenticated Session Validity Extension via Checksum Bypass

Title source: llm

Description

It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10136

Third Party Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/109029

Scores

CVSS v3 4.3

EPSS 0.0010

EPSS Percentile 27.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-347

Status published

Products (2)

redhat/satellite 5.8

redhat/spacewalk < 2.9

Published Jul 02, 2019

Tracked Since Feb 18, 2026