{"id":"CVE-2021-3584","details":"A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.","modified":"2026-07-08T05:59:45.786472031Z","published":"2021-12-23T20:15:11.533Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"}],"source":"CPE_STRING","vendor_product":"redhat:satellite","cpes":["cpe:2.3:o:redhat:satellite:6.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1968439"},{"type":"FIX","url":"https://github.com/theforeman/foreman/pull/8599"},{"type":"FIX","url":"https://projects.theforeman.org/issues/32753"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman","events":[{"introduced":"0"},{"fixed":"e36025531c54ade230139587c913af2ef21a5cdf"},{"introduced":"4cb58d3daed9474d7e348df218574ac418a3dfd8"},{"fixed":"58313c172fcb2d626e9a6d9f108c078fd2f273b3"},{"introduced":"75e6a98a21afb4e6a07cd3e6f654e61fdbdde4c1"},{"last_affected":"e91dafe4e4561441aec02d646dea2677b796c00a"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:3.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:3.0.0:rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"2.4.1"},{"introduced":"2.5.0"},{"fixed":"2.5.1"},{"introduced":"3.0.0-rc1"},{"last_affected":"3.0.0-rc1"},{"introduced":"3.0.0-rc2"},{"last_affected":"3.0.0-rc2"}]}}],"versions":["3.0.0-rc1","3.0.0-rc2","2.5.0","2.4.0","2.4.0-rc3","2.4.0-rc2","2.4.0-rc1","1.1","1.1RC5","1.1RC4","1.1RC3","1.1RC2","1.1RC1","1.0","1.0RC5","1.0RC4","1.0RC3","1.0RC2","1.0RC1","0.4","0.4rc5","0.4rc4","0.4rc3","0.4rc2","0.3","0.2","0.2rc1","0.1-6","0.1-5","0.1-4","0.1-3","0.1-2","0.1-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3584.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman-installer","events":[{"introduced":"0"},{"fixed":"71137aba07011c320fc282da3119dcbe169d6e47"},{"introduced":"0ecc28870a830e2e0d788a468f04958f17db92c9"},{"fixed":"8cdd1c33ea1df8f6defa5efdca71f81f851c7100"},{"introduced":"4f02bd3ec2d135fb14dcd9a8b3283048104a3758"},{"last_affected":"59e7e2b04b251f2b19b6ce877f16b83c5c234281"}],"database_specific":{"cpe":["cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:3.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:3.0.0:rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"2.4.1"},{"introduced":"2.5.0"},{"fixed":"2.5.1"},{"introduced":"3.0.0-rc1"},{"last_affected":"3.0.0-rc1"},{"introduced":"3.0.0-rc2"},{"last_affected":"3.0.0-rc2"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["3.0.0-rc1","3.0.0-rc2","2.4.0","2.5.0","2.4.0-rc3","2.4.0-rc2","2.4.0-rc1","1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3584.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/smart-proxy","events":[{"introduced":"0"},{"fixed":"d6d515c7ccd7b63243ae8be8f4aa506faf2a33b2"},{"introduced":"9db8be445d447b3e0d1007f188ce32c89b20da78"},{"fixed":"813a2c3a374244aaa587ab508cf8b08b35a51ead"},{"introduced":"ce1ba3136a90dc8f4b6fbc09bc8b42e48999eb79"},{"last_affected":"63b4b63fa2abf44d4c5661ca34f307d3801ff39b"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.4.1"},{"introduced":"2.5.0"},{"fixed":"2.5.1"},{"introduced":"3.0.0-rc1"},{"last_affected":"3.0.0-rc1"},{"introduced":"3.0.0-rc2"},{"last_affected":"3.0.0-rc2"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:3.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:3.0.0:rc2:*:*:*:*:*:*"]}}],"versions":["3.0.0-rc1","3.0.0-rc2","2.5.0","2.4.0","2.4.0-rc3","2.4.0-rc2","2.4.0-rc1","1.1","1.1RC3","1.1RC2","1.1RC1","1.0","1.0RC2","1.0RC1","0.3","0.2","0.2rc2","0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3584.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}