Satellite vulnerabilities
23 known vulnerabilities in Satellite from Red Hat. 21 are rated high or critical, and 4 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand
- 9.1 Critical severity
Red Hat Satellite 6.16 for RHEL 8: Privilege Defined With Unsafe Actions
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sens
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Control of Generation of Code
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engin
- 7.7 High severity
Red Hat Satellite 6.16 for RHEL 8: Deserialization of Untrusted Data
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution ch
- 8.2 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (d
- 8.2 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intend
- 7.5 High severity
Red Hat Satellite 6.16 for RHEL 8: Missing Authentication for Critical Functionality
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than it
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Incorrect Privilege Assignment
A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including adminis
- 7.8 High severity
Red Hat Satellite 6.18: Improper Authentication
A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret se
- 6.5 Medium severity
Kludex Starlette HTTP Request/Response Smuggling Exploited
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when proce
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when cons
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the B
- 9.8 Critical severity
Red Hat Satellite 6.13 for RHEL 8: Improper Authentication
An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restriction
- 9.8 Critical severity
Red Hat Satellite 6.13 for RHEL 8: Improper Authentication
An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on under
- 7.5 High severity
An arithmetic overflow flaw was found in Satellite when creating a new personal access token.
An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integ
- 8.1 High severity
candlepin-4.3.7: Incorrect Authorization
An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.
- 9.1 Critical severity
foreman: Improper Neutralization of Special Elements used in an OS Command
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command exec
- 9.1 Critical severity
foreman: Improper Control of Generation of Code
An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.
- 9.1 Critical severity
Red Hat Satellite 6.11 for RHEL 7: Improper Neutralization of Special Elements used in an OS Command
An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
- 9.8 Critical severity
Oracle Java SE and JRockit Unspecified Exploited
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
- 5.0 Medium severity
Oracle Java SE Integrity Check Exploited
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
- 9.8 Critical severity
Oracle Java SE and Java SE Embedded Remote Code Execution Exploited
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-201