{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for Red Hat CloudForms Management Engine that fixes one security\nissue, several bugs, and adds one enhancement is now available from the Red\nHat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from the\nCVE link in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat CloudForms Management Engine provides the insight, control, and\nautomation needed to address the challenges of managing virtual\nenvironments.\n\nAn input sanitization flaw was found in Red Hat CloudForms Management\nEngine. A user with administrative access to Red Hat CloudForms Management\nEngine could use this flaw to execute arbitrary Ruby code with root\nprivileges. (CVE-2013-4172)\n\nThis issue was discovered by James Laska of Red Hat.\n\nThis update also fixes several bugs and adds one enhancement. Documentation\nfor these changes will be available shortly from the CloudForms 2.0\nManagement Engine 5.1 Technical Notes, linked to in the References.\n\nAll users of Red Hat CloudForms Management Engine are advised to apply this\nupdate, which corrects this issue, and fixes the bugs and adds the\nenhancement noted in the Technical Notes. Refer to the Solution section of\nthis erratum for installation instructions.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2013:1157", "url": "https://access.redhat.com/errata/RHSA-2013:1157" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/site/articles/450563", "url": "https://access.redhat.com/site/articles/450563" }, { "category": "external", "summary": "https://access.redhat.com/site/documentation/en-US/CloudForms/2.0/html/Management_Engine_5.1_Technical_Notes/index.html", "url": "https://access.redhat.com/site/documentation/en-US/CloudForms/2.0/html/Management_Engine_5.1_Technical_Notes/index.html" }, { "category": "external", "summary": "988644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=988644" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1157.json" } ], "title": "Red Hat Security Advisory: Red Hat CloudForms Management Engine security update", "tracking": { "current_release_date": "2026-06-27T12:05:13+00:00", "generator": { "date": "2026-06-27T12:05:13+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.2.6" } }, "id": "RHSA-2013:1157", "initial_release_date": "2013-08-19T16:46:00+00:00", "revision_history": [ { "date": "2013-08-19T16:46:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2013-08-19T16:53:34+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-06-27T12:05:13+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat CloudForms 2.0", "product": { "name": "Red Hat CloudForms 2.0", "product_id": "Red Hat CloudForms 2.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:cloudforms:2.0" } } } ], "category": "product_family", "name": "Red Hat CloudForms" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "James Laska" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2013-4172", "cwe": { "id": "CWE-96", "name": "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')" }, "discovery_date": "2013-07-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "988644" } ], "notes": [ { "category": "description", "text": "The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.", "title": "Vulnerability description" }, { "category": "summary", "text": "interface: Ruby code injection", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat CloudForms 2.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-4172" }, { "category": "external", "summary": "RHBZ#988644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=988644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4172", "url": "https://www.cve.org/CVERecord?id=CVE-2013-4172" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4172", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4172" } ], "release_date": "2013-08-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-08-19T16:46:00+00:00", "details": "This update is provided in a fixpack, available from:\n\nhttps://rhn.redhat.com/rhn/software/channel/downloads/Download.do?cid=17971\n\nTo install the fixpack, follow the instructions in the following Red Hat\nKnowledge Base article:\n\nhttps://access.redhat.com/site/articles/450563", "product_ids": [ "Red Hat CloudForms 2.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:1157" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 8.5, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0" }, "products": [ "Red Hat CloudForms 2.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "interface: Ruby code injection" } ] }