{"id":"CVE-2020-35458","aliases":["EUVD-2020-23132","GHSA-mjxr-7f24-c564","SUSE-SU-2021:0088-1","SUSE-SU-2021:0089-1","SUSE-SU-2021:0090-1","SUSE-SU-2021:0192-1","SUSE-SU-2021:0198-1","SUSE-SU-2021:0200-1","openSUSE-SU-2021:0054-1","openSUSE-SU-2021:0074-1","openSUSE-SU-2021:0144-1","openSUSE-SU-2021:0147-1","openSUSE-SU-2024:12952-1"],"status":"published","title":"An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code...","description":"An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05562,"percentile":0.92915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78","CWE-94"],"published":"2021-01-12T13:33:48Z","modified":"2026-10-20T10:54:20Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"hawk2","fixed_in":["2.3.0+git.1603969748.10468582-3.18.1","2.4.0+git.1611141202.2fe6369e-3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"hawk2","fixed_in":["2.3.0+git.1603969748.10468582-3.18.1","2.4.0+git.1611141202.2fe6369e-3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"hawk2","fixed_in":["2.3.0+git.1603969748.10468582-3.18.1","2.4.0+git.1611141202.2fe6369e-3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP4","package":"hawk2","fixed_in":["2.4.0+git.1607523195.05cd3222-3.21.1","2.5.0+git.1611141696.64c61e0c-3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"hawk2","fixed_in":["2.4.0+git.1607523195.05cd3222-3.21.1","2.5.0+git.1611141696.64c61e0c-3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"hawk2","fixed_in":["2.4.0+git.1607523195.05cd3222-2.33.1","2.5.0+git.1611141696.64c61e0c-2.36.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"hawk2","fixed_in":["2.3.0+git.1603969748.10468582-lp152.2.9.1","2.4.0+git.1611141202.2fe6369e-lp152.2.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"hawk2","fixed_in":["2.3.0+git.1603969748.10468582-lp151.2.18.1","2.4.0+git.1611141202.2fe6369e-lp151.2.21.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+git.1603969748.10468582-3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+git.1603969748.10468582-3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+git.1603969748.10468582-3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP4","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+git.1607523195.05cd3222-3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+git.1607523195.05cd3222-3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+git.1607523195.05cd3222-2.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP4","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0+git.1611141696.64c61e0c-3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0+git.1611141696.64c61e0c-3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0+git.1611141696.64c61e0c-2.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+git.1611141202.2fe6369e-3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+git.1611141202.2fe6369e-3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+git.1611141202.2fe6369e-3.21.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+git.1603969748.10468582-lp152.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+git.1603969748.10468582-lp151.2.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+git.1611141202.2fe6369e-lp152.2.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+git.1611141202.2fe6369e-lp151.2.21.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4+git.1682509819.1ff135ea-1.1"}]}],"bundled":3}],"products":[{"vendor":"clusterlabs","product":"hawk"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1179998","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/ClusterLabs/hawk/releases","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2021/01/12/3","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/12/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35458"},{"url":"https://github.com/advisories/GHSA-mjxr-7f24-c564"},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210088-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179998","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35458","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210089-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210090-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210192-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210198-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210200-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VO5ZHH4IHE4JSXKLL5QNLXOG2AGDRLET/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SOXP4NYYMFT7XRFF2RMNSWISI2EL5AIV/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DNP2UKCT3X4BSG36I6GNTIIY4ETH3NYP/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SO3NRDHGVEML362SDTPCVE3FO4TKG3ZX/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25314","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-35458","description":"An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.","status":"published","published":"2021-01-12T14:21:23Z","modified":"2024-08-04T17:02:07.983Z","updated_at":"2026-11-02T14:35:57.67317Z"}],"euvd":[{"id":"EUVD-2020-23132","description":"An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.","status":"published","published":"2021-01-12T14:21:23Z","modified":"2024-08-04T17:02:07Z","updated_at":"2026-11-03T03:07:06.389211Z"}],"ghsa":[{"id":"GHSA-mjxr-7f24-c564","title":"An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code...","description":"An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.","status":"published","published":"2022-05-24T17:38:37Z","modified":"2023-01-29T05:05:00Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:45:41.213171Z"}],"nvd":[{"id":"CVE-2020-35458","description":"An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.","status":"published","published":"2021-01-12T15:15:13.89Z","modified":"2026-06-17T03:13:44.677Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:28.892872Z"}],"osv":[{"id":"CVE-2020-35458","description":"An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.","status":"published","published":"2021-01-12T15:15:13.89Z","modified":"2026-10-20T10:54:20.504096672Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"openSUSE-SU-2021:0054-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following security issue:\n\n- CVE-2020-35458: Fixed an insufficient input handler that could have led to remote code execution (bsc#1179998).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-13T17:12:36Z","modified":"2026-02-04T02:53:52.579897Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0074-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following security issue:\n\n- CVE-2020-35458: Fixed an insufficient input handler that could have led to remote code execution (bsc#1179998).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-16T10:05:46Z","modified":"2026-02-04T02:16:23.830849Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0144-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following issues:\n\nhawk2 was updated to version 2.4.0+git.1611141202.2fe6369e.\n\nSecurity issue fixed:\n\n- Fixed another possible code execution vulnerability in the controller code (bsc#1179998).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-23T05:41:59Z","modified":"2026-02-04T03:06:25.361669Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0147-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following issues:\n\nhawk2 was updated to version 2.4.0+git.1611141202.2fe6369e.\n\nSecurity issue fixed:\n\n- Fixed another possible code execution vulnerability in the controller code (bsc#1179998).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-24T05:12:14Z","modified":"2026-02-04T03:24:52.205651Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:12952-1","title":"hawk2-2.6.4+git.1682509819.1ff135ea-1.1 on GA media","description":"These are all security issues fixed in the hawk2-2.6.4+git.1682509819.1ff135ea-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:18:29.280379Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2021:0088-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following security issue:\n\n- CVE-2020-35458: Fixed an insufficient input handler that could have led to remote code execution (bsc#1179998).\n","status":"published","published":"2021-01-12T13:33:48Z","modified":"2025-05-02T04:10:15.930737Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0089-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following security issue:\n\n- CVE-2020-35458: Fixed an insufficient input handler that could have led to remote code execution (bsc#1179998).\n","status":"published","published":"2021-01-12T13:34:06Z","modified":"2026-02-04T04:03:16.471244Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0090-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following security issue:\n\n- CVE-2020-35458: Fixed an insufficient input sanitation that could have led to remote code execution (bsc#1179998).\n","status":"published","published":"2021-01-12T13:34:21Z","modified":"2026-02-04T03:26:13.754646Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0192-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following issues:\n\nhawk2 was updated to version 2.5.\n\nSecurity issue fixed:\n\n- Fixed another possible code execution vulnerability in the controller code (bsc#1179998).\n","status":"published","published":"2021-01-22T09:36:50Z","modified":"2026-02-04T04:07:54.671607Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0198-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following issues:\n\nhawk2 was updated to version 2.5.\n\nSecurity issue fixed:\n\n- Fixed another possible code execution vulnerability in the controller code (bsc#1179998).\n","status":"published","published":"2021-01-22T14:17:54Z","modified":"2026-02-04T04:24:26.842302Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0200-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following issues:\n\nhawk2 was updated to version 2.4.0+git.1611141202.2fe6369e.\n\nSecurity issue fixed:\n\n- Fixed another possible code execution vulnerability in the controller code (bsc#1179998).\n","status":"published","published":"2021-01-22T14:39:46Z","modified":"2026-02-04T03:47:28.131874Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}