CVE-2021-3584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-3584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-3584
Downstream
Published
2021-12-23T20:15:11.533Z
Modified
2026-07-08T05:59:45.786472031Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:satellite:6.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:satellite",
            "extracted_events": [
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git
github.com/theforeman/foreman

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/foreman
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e36025531c54ade230139587c913af2ef21a5cdf
Introduced
4cb58d3daed9474d7e348df218574ac418a3dfd8
Fixed
58313c172fcb2d626e9a6d9f108c078fd2f273b3
Introduced
75e6a98a21afb4e6a07cd3e6f654e61fdbdde4c1
Last affected
e91dafe4e4561441aec02d646dea2677b796c00a
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.1"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.5.1"
        },
        {
            "introduced": "3.0.0-rc1"
        },
        {
            "last_affected": "3.0.0-rc1"
        },
        {
            "introduced": "3.0.0-rc2"
        },
        {
            "last_affected": "3.0.0-rc2"
        }
    ],
    "cpe": [
        "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:theforeman:foreman:3.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:theforeman:foreman:3.0.0:rc2:*:*:*:*:*:*"
    ]
}

Affected versions

0.*
0.1-1
0.1-2
0.1-3
0.1-4
0.1-5
0.1-6
0.2
0.2rc1
0.3
0.4
0.4rc2
0.4rc3
0.4rc4
0.4rc5
1.*
1.0
1.0RC1
1.0RC2
1.0RC3
1.0RC4
1.0RC5
1.1
1.1RC1
1.1RC2
1.1RC3
1.1RC4
1.1RC5
2.*
2.4.0
2.4.0-rc1
2.4.0-rc2
2.4.0-rc3
2.5.0
3.*
3.0.0-rc1
3.0.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3584.json"
github.com/theforeman/foreman-installer

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/foreman-installer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
71137aba07011c320fc282da3119dcbe169d6e47
Introduced
0ecc28870a830e2e0d788a468f04958f17db92c9
Fixed
8cdd1c33ea1df8f6defa5efdca71f81f851c7100
Introduced
4f02bd3ec2d135fb14dcd9a8b3283048104a3758
Last affected
59e7e2b04b251f2b19b6ce877f16b83c5c234281
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.1"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.5.1"
        },
        {
            "introduced": "3.0.0-rc1"
        },
        {
            "last_affected": "3.0.0-rc1"
        },
        {
            "introduced": "3.0.0-rc2"
        },
        {
            "last_affected": "3.0.0-rc2"
        }
    ],
    "cpe": [
        "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:theforeman:foreman:3.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:theforeman:foreman:3.0.0:rc2:*:*:*:*:*:*"
    ]
}

Affected versions

1.*
1.0.1
2.*
2.4.0
2.4.0-rc1
2.4.0-rc2
2.4.0-rc3
2.5.0
3.*
3.0.0-rc1
3.0.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3584.json"
github.com/theforeman/smart-proxy

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/smart-proxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d6d515c7ccd7b63243ae8be8f4aa506faf2a33b2
Introduced
9db8be445d447b3e0d1007f188ce32c89b20da78
Fixed
813a2c3a374244aaa587ab508cf8b08b35a51ead
Introduced
ce1ba3136a90dc8f4b6fbc09bc8b42e48999eb79
Last affected
63b4b63fa2abf44d4c5661ca34f307d3801ff39b
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.1"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.5.1"
        },
        {
            "introduced": "3.0.0-rc1"
        },
        {
            "last_affected": "3.0.0-rc1"
        },
        {
            "introduced": "3.0.0-rc2"
        },
        {
            "last_affected": "3.0.0-rc2"
        }
    ],
    "cpe": [
        "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:theforeman:foreman:3.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:theforeman:foreman:3.0.0:rc2:*:*:*:*:*:*"
    ]
}

Affected versions

0.*
0.1
0.2
0.2rc2
0.3
1.*
1.0
1.0RC1
1.0RC2
1.1
1.1RC1
1.1RC2
1.1RC3
2.*
2.4.0
2.4.0-rc1
2.4.0-rc2
2.4.0-rc3
2.5.0
3.*
3.0.0-rc1
3.0.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3584.json"