CVE-2021-3584

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.

• CWE-78

• https://bugzilla.redhat.com/show_bug.cgi?id=1968439Issue Tracking, Third Party Advisory
• https://github.com/theforeman/foreman/pull/8599Issue Tracking, Patch, Third Party Advisory
• https://projects.theforeman.org/issues/32753Issue Tracking, Patch, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1968439Issue Tracking, Third Party Advisory
• https://github.com/theforeman/foreman/pull/8599Issue Tracking, Patch, Third Party Advisory
• https://projects.theforeman.org/issues/32753Issue Tracking, Patch, Vendor Advisory

Published

Dec 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3578A flaw was found in mbsync before v1.3.6 and v1.4.2, where a…7.8
• CVE-2021-3579Incorrect Default Permissions vulnerability in the bdservice…7.8
• CVE-2021-3580A flaw was found in the way nettle's RSA decryption function…7.5
• CVE-2021-3581Buffer Access with Incorrect Length Value in zephyr. Zephyr …8.8
• CVE-2021-3582A flaw was found in the QEMU implementation of VMWare's para…6.5
• CVE-2021-3583A flaw was found in Ansible, where a user's controller is vu…7.1
• CVE-2021-3585A flaw was found in openstack-tripleo-heat-templates. Plain …5.5
• CVE-2021-3586A flaw was found in servicemesh-operator. The NetworkPolicy …9.8
• CVE-2021-3587Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-3588The cli_feat_read_cb() function in src/gatt-database.c does …3.3
• CVE-2021-3589An authorization flaw was found in Foreman Ansible. An authe…8
• CVE-2021-3590A flaw was found in Foreman project. A credential leak was i…8.8