{"id":"CVE-2019-10137","aliases":["EUVD-2019-2177","GHSA-38jq-w3g8-jpc9","RHSA-2019:1663","SUSE-SU-2019:1789-1","SUSE-SU-2019:1790-1"],"status":"published","title":"A path traversal flaw was found in spacewalk-proxy, all versions through 2.8, in the way the...","description":"A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.03121,"percentile":0.87918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2019-07-02T19:28:32Z","modified":"2026-06-29T10:25:20Z","fixes":[{"ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-backend","fixed_in":["0:2.5.3-177.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-backend-libs","fixed_in":["0:2.5.3-177.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy","fixed_in":["0:2.5.0-8.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-broker","fixed_in":["0:2.5.0-8.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-common","fixed_in":["0:2.5.0-8.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-management","fixed_in":["0:2.5.0-8.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-package-manager","fixed_in":["0:2.5.0-8.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-redirect","fixed_in":["0:2.5.0-8.el6sat"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-177.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-backend-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-177.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-8.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-8.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-8.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-8.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-package-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-8.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:5.8::el6","package":"spacewalk-proxy-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-8.el6sat"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.22-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.22-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-0.16.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.17-3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.6-3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.17-3.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-6.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.17-3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.17-3.30.1"}]}],"bundled":2}],"products":[{"vendor":"redhat","product":"satellite"},{"vendor":"redhat","product":"spacewalk"},{"vendor":"spacewalkproject","product":"spacewalk-proxy"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10137","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1663","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702604","tags":["report"]},{"url":"https://github.com/advisories/GHSA-38jq-w3g8-jpc9"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1663.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10137","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191789-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136476","tags":["report"]},{"url":"https://bugzilla.suse.com/1136480","tags":["report"]},{"url":"https://bugzilla.suse.com/1136561","tags":["report"]},{"url":"https://bugzilla.suse.com/1136857","tags":["report"]},{"url":"https://bugzilla.suse.com/1137955","tags":["report"]},{"url":"https://bugzilla.suse.com/1138313","tags":["report"]},{"url":"https://bugzilla.suse.com/1138358","tags":["report"]},{"url":"https://bugzilla.suse.com/1138364","tags":["report"]},{"url":"https://bugzilla.suse.com/1139693","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191790-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1102770","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-10137","description":"A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.","status":"published","published":"2019-07-02T19:28:32Z","modified":"2024-08-04T22:10:10.032Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-2177","description":"A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.","status":"published","published":"2019-07-02T19:28:32Z","modified":"2024-08-04T22:10:10Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:53.61807Z"}],"ghsa":[{"id":"GHSA-38jq-w3g8-jpc9","title":"A path traversal flaw was found in spacewalk-proxy, all versions through 2.8, in the way the...","description":"A path traversal flaw was found in spacewalk-proxy, all versions through 2.8, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.","status":"published","published":"2022-05-24T16:49:15Z","modified":"2023-02-10T05:06:41Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:54:02.310741Z"}],"nvd":[{"id":"CVE-2019-10137","description":"A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.","status":"published","published":"2019-07-02T20:15:11.45Z","modified":"2026-06-17T02:10:20.02Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:17.695191Z"}],"osv":[{"id":"RHSA-2019:1663","title":"Red Hat Security Advisory: spacewalk-backend and spacewalk-proxy security update","status":"published","published":"2024-09-13T19:52:23Z","modified":"2026-06-29T10:25:20Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"SUSE-SU-2019:1789-1","title":"Security update for SUSE Manager Server 4.0","description":"\nThis update fixes the following issues:\n\nspacewalk-backend:\n\n- Do not duplicate 'http://' protocol when using proxies with 'deb'\n  repositories (bsc#1138313)\n- Fix reposync when dealing with RedHat CDN (bsc#1138358)\n- Fix for CVE-2019-10136. An attacker with a valid, but expired,\n  authenticated set of headers could move some digits around,\n  artificially extending the session validity without modifying\n  the checksum. (bsc#1136480)\n\nspacewalk-web:\n\n- Change WebUI version 4.0.1\n\nsusemanager-doc-indexes:\n\n- Updated wording for prometheus section\n- Jeos VM update\n- Port 8050 for graphical console display\n- Content life-cycle docs are not enough for customer to understand (bsc#1137955)\n- Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)\n- Certificate verify failed when using vmware esxi virtual host gatherer (bsc#1136561)\n\nsusemanager-docs_en:\n\n- Updated wording for prometheus section\n- Jeos VM update\n- Port 8050 for graphical console display\n- Content life-cycle docs are not enough for customer to understand (bsc#1137955)\n- Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)\n- Certificate verify failed when using vmware esxi virtual host gatherer (bsc#1136561)\n\nsusemanager-sync-data:\n\n- Add channel family definitions for SLES12 SP3 LTSS (bsc#1139693)\n- Add OPENSUSE to allowed channel_families to make\n  openSUSE Leap product visible in the product list (bsc#1138364)\n\n","status":"published","published":"2019-07-09T13:21:45Z","modified":"2026-02-04T02:42:00.576876Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1790-1","title":"Security update for SUSE Manager Server 3.2","description":"\nThis update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Fix invalid characters in ncurses mode (bsc#1102770)\n\nspacewalk-backend:\n\n- Fix for CVE-2019-10136. An attacker with a valid, but expired,\n  authenticated set of headers could move some digits around,\n  artificially extending the session validity without modifying\n  the checksum. (bsc#1136480)\n\nspacewalk-web:\n\n- Change WebUI string version to 3.2.9\n\n","status":"published","published":"2019-07-09T13:22:02Z","modified":"2026-02-04T04:10:59.604867Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}