Red Hat Security AdvisoryRHSA-2014:0148
spacewalk-java, spacewalk-web and satellite-branding security update
Released 2014-02-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Satellite 5.6 (RHEL v.5) satellite-branding-5.6.0.23-1.el5sat, spacewalk-base-2.0.3-19.el5sat, spacewalk-base-minimal-2.0.3-19.el5sat +13
- Red Hat Satellite 5.6 (RHEL v.6) satellite-branding-5.6.0.23-1.el6sat, spacewalk-base-2.0.3-19.el6sat, spacewalk-base-minimal-2.0.3-19.el6sat +13
- Red Hat Satellite Managed DB 5.6 (RHEL v.5) spacewalk-base-minimal-2.0.3-19.el5sat, spacewalk-dobby-2.0.3-19.el5sat, spacewalk-web-2.0.3-19.el5sat
- Red Hat Satellite Managed DB 5.6 (RHEL v.6) spacewalk-base-minimal-2.0.3-19.el6sat, spacewalk-dobby-2.0.3-19.el6sat, spacewalk-web-2.0.3-19.el6sat
Fixes 4 records
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) whereCriteria variable in a software chan…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01732 · Published 2014-02-14 · Fixed CWE-79
Priority LOW 24
CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.0185 · Published 2014-04-01 · Fixed CWE-20
Priority LOW 20
Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter.
CVSS 2.0LOW 3.5· Network · Low privileges · Interaction — · EPSS 0.01593 · Published 2014-02-14 · Fixed CWE-79
Priority LOW 20
Multiple cross-site scripting (XSS) vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) c…
CVSS 2.0LOW 3.5· Network · Low privileges · Interaction — · EPSS 0.01573 · Published 2014-02-14 · Fixed CWE-79
THREATIST.IORead the docs