CVE-2019-10136: redhat satellite
CVSS: 4.3v3.0MediumModified
AliasesSUSE-SU-2019:14163-1SUSE-SU-2019:2312-1SUSE-SU-2019:2317-1RHSA-2019:1661
Published 02-07-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-10136 is a medium (CVSS 4.3) vulnerability in redhat satellite. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.4% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v3.0 (CVE.org)EPSS score
0.57%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 02-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 4.3Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSourcesAll 3 agree
- NVDNIST4.3MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated4.3MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.57% on 20-09-2026
20-09-202620-10-2026
EPSS score0.57%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse36 products
- golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 15< 0.16.2-3.3.1
- golang-github-prometheus-prometheus&distro=SUSE Manager Client Tools 12< 2.11.1-1.6.2
- golang-github-prometheus-prometheus&distro=SUSE Manager Client Tools 15< 2.11.1-3.6.2
- kiwi-desc-saltboot&distro=SUSE Manager Client Tools 12< 0.1.1564399963.cf19a13-1.12.1
- mgr-cfg&distro=SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS< 4.0.9-5.6.3
Redhat20 products
- satellite5.8
- spacewalk≤ 2.9
- spacewalk-backend< 0:2.5.3-177.el6sat
- spacewalk-backend-app< 0:2.5.3-177.el6sat
- spacewalk-backend-applet< 0:2.5.3-177.el6sat
Spacewalkproject1 product
- spacewalkspacewalk all through 2.9
3 vendors · 57 products
