RHSA-2026:74506
Vulnerability from csaf_redhat - Published: 2026-10-01 23:06 - Updated: 2026-10-02 14:44Summary
Red Hat Security Advisory: Satellite 6.16.14 Async Update
Severity
Critical
Notes
Topic: An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* python-dynaconf: Dynaconf: Arbitrary code execution via Server-Side Template Injection [rhn_satellite_6.16] (CVE-2026-33154)
* foreman: Excessive Permissions for Viewer Role on Preview [rhn_satellite_6.16] (CVE-2026-96659)
* foreman: Safemode Bypass leading to RCE [rhn_satellite_6.16] (CVE-2026-96658)
* satellite:el8/python-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing [rhn_satellite_6.16] (CVE-2026-59893)
* python-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing [rhn_satellite_6.16] (CVE-2026-59893)
* satellite:el8/python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing [rhn_satellite_6.16] (CVE-2026-54284)
* python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing [rhn_satellite_6.16] (CVE-2026-54284)
* satellite:el8/yggdrasil-worker-forwarder: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages [rhn_satellite_6.16] (CVE-2026-56862)
* satellite:el8/yggdrasil-worker-forwarder: Go html/template: Cross-Site Scripting via pathological input [rhn_satellite_6.16] (CVE-2026-56858)
* satellite:el8/yggdrasil-worker-forwarder: golang net/url: Denial of Service from quadratic complexity in path resolution [rhn_satellite_6.16] (CVE-2026-56860)
* satellite:el8/yggdrasil-worker-forwarder: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal [rhn_satellite_6.16] (CVE-2026-33818)
* satellite:el8/rubygem-katello: Katello Content View History API Cross-Organization Authorization Bypass [rhn_satellite_6.16] (CVE-2026-79654)
* python-gitpython: GitPython: Arbitrary file read via TagReference.create() [rhn_satellite_6.16] (CVE-2026-78679)
* python-gitpython: GitPython: Remote Code Execution via Git directory impersonation [rhn_satellite_6.16] (CVE-2026-87817)
* satellite-capsule:el8/python-lxml: lxml: URL bypass vulnerability in Cleaner via missing xlink:href [rhn_satellite_6.16] (CVE-2026-49825)
* yggdrasil-worker-forwarder: Golang MIME: Denial of Service via maliciously-crafted MIME header [rhn_satellite_6.16] (CVE-2026-42504)
* satellite:el8/yggdrasil-worker-forwarder: Golang MIME: Denial of Service via maliciously-crafted MIME header [rhn_satellite_6.16] (CVE-2026-42504)
* rubygem-katello: Katello Content View History API Cross-Organization Authorization Bypass [rhn_satellite_6.16] (CVE-2026-79654)
* yggdrasil-worker-forwarder: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal [rhn_satellite_6.16] (CVE-2026-33818)
* yggdrasil-worker-forwarder: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages [rhn_satellite_6.16] (CVE-2026-56862)
* yggdrasil-worker-forwarder: Go html/template: Cross-Site Scripting via pathological input [rhn_satellite_6.16] (CVE-2026-56858)
* yggdrasil-worker-forwarder: golang net/url: Denial of Service from quadratic complexity in path resolution [rhn_satellite_6.16] (CVE-2026-56860)
* satellite:el8/rubygem-katello: improper authorization logic allows resource enumeration [rhn_satellite_6.16] (CVE-2026-56098)
* rubygem-katello: improper authorization logic allows resource enumeration [rhn_satellite_6.16] (CVE-2026-56098)
* rubygem-katello: SQL injection in Registry Proxy via labels [rhn_satellite_6.16] (CVE-2026-56097)
* satellite:el8/rubygem-katello: SQL injection in Registry Proxy via labels [rhn_satellite_6.16] (CVE-2026-56097)
* satellite-utils:el8/rubygem-hammer_cli: command injection via insecure editor invocation [rhn_satellite_6.16] (CVE-2026-12545)
* rubygem-hammer_cli: command injection via insecure editor invocation [rhn_satellite_6.16] (CVE-2026-12545)
* foreman: SSTI and insecure deserialization in foreman-rake configuration [rhn_satellite_6.16] (CVE-2026-12544)
* satellite:el8/foreman: SSTI and insecure deserialization in foreman-rake configuration [rhn_satellite_6.16] (CVE-2026-12544)
* satellite:el8/foreman: command injection in foreman-tail [rhn_satellite_6.16] (CVE-2026-12542)
* foreman: command injection in foreman-tail [rhn_satellite_6.16] (CVE-2026-12542)
* satellite:el8/foreman: command injection in foreman-rake database tasks [rhn_satellite_6.16] (CVE-2026-12541)
* foreman: command injection in foreman-rake database tasks [rhn_satellite_6.16] (CVE-2026-12541)
* satellite:el8/foreman: command injection in foreman-rake errors:fetch_log via request_id parameter [rhn_satellite_6.16] (CVE-2026-12540)
* foreman: command injection in foreman-rake errors:fetch_log via request_id parameter [rhn_satellite_6.16] (CVE-2026-12540)
* satellite:el8/foreman: unauthenticated information disclosure via provisioning token validation flaw [rhn_satellite_6.16] (CVE-2026-12423)
* foreman: unauthenticated information disclosure via provisioning token validation flaw [rhn_satellite_6.16] (CVE-2026-12423)
* satellite:el8/rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter [rhn_satellite_6.16] (CVE-2026-12405)
* rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter [rhn_satellite_6.16] (CVE-2026-12405)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.
8.8 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
128 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
7.5 (High)
Affected products
Fixed
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
92 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
8.2 (High)
Affected products
Fixed
42 products, the same list as for
CVE-2026-12423
Known not affected
92 products, the same list as for
CVE-2026-12423
Threats
Impact
Important
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
8.2 (High)
Affected products
Fixed
42 products, the same list as for
CVE-2026-12423
Known not affected
92 products, the same list as for
CVE-2026-12423
Threats
Impact
Important
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
5.3 (Medium)
Affected products
Fixed
42 products, the same list as for
CVE-2026-12423
Known not affected
92 products, the same list as for
CVE-2026-12423
Threats
Impact
Moderate
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
7.7 (High)
Affected products
Fixed
42 products, the same list as for
CVE-2026-12423
Known not affected
92 products, the same list as for
CVE-2026-12423
Threats
Impact
Important
A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).
6.7 (Medium)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
126 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection (SSTI) vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template expressions in configuration values, which are then processed without a sandboxed environment. This could lead to arbitrary code execution on the affected system.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
126 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Vendor Fix
fix
|
Known not affected
130 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Threats
Impact
Important
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-33818
Known not affected
130 products, the same list as for
CVE-2026-33818
Threats
Impact
Important
A flaw was found in lxml, a library for processing XML and HTML in Python. The `lxml.html.defs.link_attrs` were missing `xlink:href`, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user's browser.
8.2 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Vendor Fix
fix
|
Known not affected
118 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Threats
Impact
Important
A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit a vulnerability in the TokenList construction and string conversion processes, specifically when handling nested token subtrees. This flaw leads to quadratic CPU consumption, which can result in a Denial of Service (DoS) by exhausting system resources before internal limits are reached.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
Known not affected
126 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Threats
Impact
Important
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
130 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.
4.3 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2026-56097
Known not affected
130 products, the same list as for
CVE-2026-56097
Threats
Impact
Moderate
A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-33818
Known not affected
130 products, the same list as for
CVE-2026-33818
Threats
Impact
Important
A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-33818
Known not affected
130 products, the same list as for
CVE-2026-33818
Threats
Impact
Important
A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-33818
Known not affected
130 products, the same list as for
CVE-2026-33818
Threats
Impact
Important
A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input. This flaw causes inefficient processing of certain SQL patterns, leading to excessive CPU consumption and potentially a Denial of Service (DoS) condition, making the application unresponsive.
7.5 (High)
Affected products
Fixed
8 products, the same list as for
CVE-2026-54284
Known not affected
126 products, the same list as for
CVE-2026-54284
Threats
Impact
Important
A flaw was found in GitPython. A remote attacker with low privileges can exploit a vulnerability in the `TagReference.create()` function, where a positional reference parameter bypasses a security guard. This allows the attacker to supply a specially crafted reference value, such as `--file=<path>`, to read arbitrary files on the system. The contents of these files are then returned within the annotated tag message, leading to information disclosure.
6.5 (Medium)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
126 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.
4.3 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2026-56097
Known not affected
130 products, the same list as for
CVE-2026-56097
Threats
Impact
Moderate
A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can then place a malicious pre-commit hook in the tracked hooks directory, which executes when a victim calls index.commit() on a cloned or opened repository.
8.8 (High)
Affected products
Fixed
8 products, the same list as for
CVE-2026-78679
Known not affected
126 products, the same list as for
CVE-2026-78679
Threats
Impact
Important
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.
9.9 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el8sat.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.16:rubygem-safemode-0:1.5.0-2.el9sat.src | — |
Vendor Fix
fix
|
Known not affected
130 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-0:3.12.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-gitpython-0:3.1.62-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-lxml-0:4.9.2-5.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el8pc.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el8pc.x86_64 | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el8pc.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.14-1.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.14-1.el8sat.noarch | — | ||
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.src | — | ||
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.el8sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-dynaconf-0:3.2.13-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-gitpython-0:3.1.62-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-0:4.9.2-5.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-4.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python-sqlparse-0:0.6.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-0:3.12.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-cli-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-debug-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-dynflow-sidekiq-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-ec2-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-journald-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-libvirt-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-openstack-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-ovirt-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-pcp-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-postgresql-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-redis-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-service-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-telemetry-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:foreman-vmware-0:3.12.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-dynaconf-0:3.2.13-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-gitpython-0:3.1.62-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-lxml-0:4.9.2-5.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-lxml-debugsource-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-4.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python-sqlparse-0:0.6.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-dynaconf-0:3.2.13-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-gitpython-0:3.1.62-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-lxml-debuginfo-0:4.9.2-5.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-4.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:python3.11-sqlparse-0:0.6.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-0:13.2.8-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-foreman_remote_execution-cockpit-0:13.2.8-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-hammer_cli-0:3.12.0-2.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:rubygem-katello-0:4.14.0.23-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.14-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.14-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.1.0-2.1.el9sat.x86_64 | — |
Threats
Impact
Critical
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
9.1 (Critical)
Affected products
Fixed
42 products, the same list as for
CVE-2026-12423
Known not affected
92 products, the same list as for
CVE-2026-12423
Threats
Impact
Important
References
153 references
Loading 1.1 MB of JSON…
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…