rhsa-2025:19856
Vulnerability from csaf_redhat
Published
2025-11-06 02:27
Modified
2025-11-06 07:04
Summary
Red Hat Security Advisory: Satellite 6.15.5.6 Async Update
Notes
Topic
An update is now available for Red Hat Satellite 6.15 for RHEL 8.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)
* rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919)
* foreman: OS command injection via ct_location and fcct_location parameters (CVE-2025-10622)
Users of Red Hat Satellite are advised to upgrade to these updated
packages, which fix these bugs.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat Satellite 6.15 for RHEL 8.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Satellite is a system management solution that allows organizations\nto configure and maintain their systems without the necessity to provide\npublic Internet access to their servers or other client systems. It\nperforms provisioning and configuration management of predefined standard\noperating environments.\n\nSecurity Fix(es):\n\n* rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)\n\n* rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919)\n\n* foreman: OS command injection via ct_location and fcct_location parameters (CVE-2025-10622)\n\nUsers of Red Hat Satellite are advised to upgrade to these updated\npackages, which fix these bugs.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:19856",
"url": "https://access.redhat.com/errata/RHSA-2025:19856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2396020",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396020"
},
{
"category": "external",
"summary": "2398167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2398167"
},
{
"category": "external",
"summary": "2403180",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403180"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19856.json"
}
],
"title": "Red Hat Security Advisory: Satellite 6.15.5.6 Async Update",
"tracking": {
"current_release_date": "2025-11-06T07:04:59+00:00",
"generator": {
"date": "2025-11-06T07:04:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.10"
}
},
"id": "RHSA-2025:19856",
"initial_release_date": "2025-11-06T02:27:41+00:00",
"revision_history": [
{
"date": "2025-11-06T02:27:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-11-06T02:27:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-06T07:04:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.15 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.15::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.15 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_capsule:6.15::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.15 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_utils:6.15::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite 6"
},
{
"branches": [
{
"category": "product_version",
"name": "foreman-0:3.9.1.13-1.el8sat.src",
"product": {
"name": "foreman-0:3.9.1.13-1.el8sat.src",
"product_id": "foreman-0:3.9.1.13-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman@3.9.1.13-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.15.5.6-1.el8sat.src",
"product": {
"name": "satellite-0:6.15.5.6-1.el8sat.src",
"product_id": "satellite-0:6.15.5.6-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.15.5.6-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-rack-0:2.2.20-1.el8sat.src",
"product": {
"name": "rubygem-rack-0:2.2.20-1.el8sat.src",
"product_id": "rubygem-rack-0:2.2.20-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rack@2.2.20-1.el8sat?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "foreman-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-cli@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-debug@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-dynflow-sidekiq@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-ec2@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-journald@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-libvirt@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-openstack@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-ovirt@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-pcp@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-postgresql@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-redis@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-service-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-service-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-service-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-service@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-telemetry@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"product": {
"name": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"product_id": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-vmware@3.9.1.13-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.15.5.6-1.el8sat.noarch",
"product": {
"name": "satellite-0:6.15.5.6-1.el8sat.noarch",
"product_id": "satellite-0:6.15.5.6-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.15.5.6-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"product": {
"name": "satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"product_id": "satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-cli@6.15.5.6-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-common-0:6.15.5.6-1.el8sat.noarch",
"product": {
"name": "satellite-common-0:6.15.5.6-1.el8sat.noarch",
"product_id": "satellite-common-0:6.15.5.6-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-common@6.15.5.6-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"product": {
"name": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"product_id": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-capsule@6.15.5.6-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-rack-0:2.2.20-1.el8sat.noarch",
"product": {
"name": "rubygem-rack-0:2.2.20-1.el8sat.noarch",
"product_id": "rubygem-rack-0:2.2.20-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rack@2.2.20-1.el8sat?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.9.1.13-1.el8sat.src as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src"
},
"product_reference": "foreman-0:3.9.1.13-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-cli-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-debug-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-journald-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-redis-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-service-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-service-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rack-0:2.2.20-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch"
},
"product_reference": "rubygem-rack-0:2.2.20-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rack-0:2.2.20-1.el8sat.src as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src"
},
"product_reference": "rubygem-rack-0:2.2.20-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.15.5.6-1.el8sat.src as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src"
},
"product_reference": "satellite-0:6.15.5.6-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-common-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.9.1.13-1.el8sat.src as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src"
},
"product_reference": "foreman-0:3.9.1.13-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-cli-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-debug-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-journald-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-redis-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-service-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-service-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.15.5.6-1.el8sat.src as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src"
},
"product_reference": "satellite-0:6.15.5.6-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-common-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.9.1.13-1.el8sat.src as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src"
},
"product_reference": "foreman-0:3.9.1.13-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-cli-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-debug-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-journald-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-redis-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-service-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-service-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch"
},
"product_reference": "foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rack-0:2.2.20-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch"
},
"product_reference": "rubygem-rack-0:2.2.20-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rack-0:2.2.20-1.el8sat.src as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src"
},
"product_reference": "rubygem-rack-0:2.2.20-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.15.5.6-1.el8sat.src as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src"
},
"product_reference": "satellite-0:6.15.5.6-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.15.5.6-1.el8sat.noarch as a component of Red Hat Satellite 6.15 for RHEL 8",
"product_id": "8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
},
"product_reference": "satellite-common-0:6.15.5.6-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.15"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Micha\u0142 Bartoszuk"
],
"organization": "stmcyber.pl"
}
],
"cve": "CVE-2025-10622",
"cwe": {
"id": "CWE-602",
"name": "Client-Side Enforcement of Server-Side Security"
},
"discovery_date": "2025-09-17T09:07:39.743000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2396020"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "foreman: OS command injection via ct_location and fcct_location parameters",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch"
],
"known_not_affected": [
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-10622"
},
{
"category": "external",
"summary": "RHBZ#2396020",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396020"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-10622",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10622"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10622",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10622"
}
],
"release_date": "2025-11-01T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-06T02:27:41+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19856"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "foreman: OS command injection via ct_location and fcct_location parameters"
},
{
"cve": "CVE-2025-59830",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-09-25T15:01:07.627558+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2398167"
}
],
"notes": [
{
"category": "description",
"text": "An unsafe default behavior in Rack::QueryParser allows bypass of the params_limit parameter count restriction when query string parameters are delimited by semicolons (;) rather than ampersands (\u0026). The parser counts only \u0026 when enforcing the limit, while still splitting on both \u0026 and ;. As a result, an attacker can supply a crafted HTTP query using ; delimiters to exceed the intended parameter count, potentially causing performance degradation or exhaustion of resources (denial of service).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The overall severity of this flaw is Moderate, because most Rack applications are not directly impacted. The vulnerability primarily affects applications or middleware that invoke Rack::QueryParser directly using its default configuration, which accepts both \u0026 and ; as parameter delimiters. This behavior can lead to excessive CPU or memory consumption, resulting only a limited denial-of-service condition.\n\nFor typical applications using Rack::Request, the default request-handling flow applies safe parsing logic and does not exhibit the vulnerable behavior.\n\nIn summary, while the theoretical severity is High, the practical impact is generally Moderate to Low for standard configurations.\n\n```\nAffectedness:\n\nIt should be noted that starting from Rack v3.x, the framework no longer splits query parameters on semicolons. This change was introduced in commit ef1fc0c44e6a4b77c8fcf9b4f3bfa09f04ae8482, effectively mitigating this issue in newer releases.\n\nRack 1.x is also not affected by this vulnerability. The vulnerable parsing logic was introduced in Rack 2.x; earlier versions use a simpler query parsing mechanism that does not expose the same resource exhaustion risk.\n```\n\n~~~\nAdditionally, Ruby 2.x and 3.x versions shipped with Red Hat Enterprise Linux are not affected, as they do not bundle the rack RubyGem by default. Rack is a third-party gem that must be installed separately.\n~~~",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src"
],
"known_not_affected": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-59830"
},
{
"category": "external",
"summary": "RHBZ#2398167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2398167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-59830",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-59830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59830"
},
{
"category": "external",
"summary": "https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71",
"url": "https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71"
},
{
"category": "external",
"summary": "https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm",
"url": "https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm"
}
],
"release_date": "2025-09-25T14:37:06.967000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-06T02:27:41+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19856"
},
{
"category": "workaround",
"details": "No action is required for typical Rack applications that use the framework\u2019s default request-handling mechanisms, as these are not impacted.\n\nFor custom implementations or middleware that directly invoke Rack::QueryParser, administrators should:\n\nUse explicit delimiters: Configure QueryParser to use a specific delimiter (e.g. \u0026) rather than accepting both \u0026 and ;.\n\nLimit request size and parameters: Enforce request size and parameter count limits at upstream layers (such as a web server, reverse proxy, or WAF) to prevent excessive resource consumption.\n\nPrefer safe APIs: Use Rack::Request or other higher-level request parsing APIs, which apply safe defaults and avoid this vulnerability.",
"product_ids": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters"
},
{
"cve": "CVE-2025-61919",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2025-10-10T20:01:19.001907+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2403180"
}
],
"notes": [
{
"category": "description",
"text": "A memory-exhaustion vulnerability exists in Rack when parsing application/x-www-form-urlencoded request bodies. Rack::Request#POST reads the entire request body into memory without enforcing a maximum length or cap. Attackers can exploit this by sending large form submissions, potentially causing denial of service (DoS) through memory exhaustion. Even with configured parsing limits, the issue occurs before those limits are enforced, allowing unbounded memory allocation proportional to request size.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "~~~\n\nAffectedness:\n\nRack 1.x, including 1.6.x, is not affected by this vulnerability. The issue exists only in Rack 2.x and 3.x, where request parsing was refactored into the QueryParser component. Since Rack 1.x does not include this component, it does not contain the vulnerable logic.\n\nRuby 2.x and 3.x versions shipped with Red Hat Enterprise Linux, Red Hat Openshift Core OS (RHOCS) and Red Hat In-Vehicle OS (RHIVOS) are not affected, as they do not bundle the rack RubyGem by default. Rack is a third-party gem that must be installed separately.\n\n~~~",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src"
],
"known_not_affected": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61919"
},
{
"category": "external",
"summary": "RHBZ#2403180",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403180"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61919",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61919"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61919",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61919"
},
{
"category": "external",
"summary": "https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881",
"url": "https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881"
},
{
"category": "external",
"summary": "https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db",
"url": "https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db"
},
{
"category": "external",
"summary": "https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f",
"url": "https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f"
},
{
"category": "external",
"summary": "https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm",
"url": "https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm"
}
],
"release_date": "2025-10-10T19:22:42.454000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-06T02:27:41+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19856"
},
{
"category": "workaround",
"details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability beyond these configuration-based workarounds.",
"product_ids": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-capsule:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-capsule:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-capsule:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15-utils:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15-utils:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15-utils:satellite-common-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-0:3.9.1.13-1.el8sat.src",
"8Base-satellite-6.15:foreman-cli-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-debug-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-dynflow-sidekiq-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ec2-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-journald-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-libvirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-openstack-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-ovirt-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-pcp-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-postgresql-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-redis-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-service-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-telemetry-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:foreman-vmware-0:3.9.1.13-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.noarch",
"8Base-satellite-6.15:rubygem-rack-0:2.2.20-1.el8sat.src",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-0:6.15.5.6-1.el8sat.src",
"8Base-satellite-6.15:satellite-capsule-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-cli-0:6.15.5.6-1.el8sat.noarch",
"8Base-satellite-6.15:satellite-common-0:6.15.5.6-1.el8sat.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…