Red Hat Security AdvisoryRHSA-2019:1222
Satellite 6.5 Release
Released 2019-05-14 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Satellite 6.5 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.6-1.el7sat, candlepin-2.5.15-1.el7sat +47
- Red Hat Satellite Capsule 6.5 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.6-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
Fixes 6 records
Priority MEDIUM 41
RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.05601 · Published 2016-09-07 · Partial fix · 3.0.20.Final
Priority LOW 35
It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00679 · Published 2019-04-12 · Fixed CWE-532
Priority LOW 35
A cross-site scripting (XSS) flaw was found in the foreman component of satellite.
CVSS 3.0HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00878 · Published 2018-12-07 · Fixed CWE-79
Priority LOW 32
pulp 2.16.x and possibly older is vulnerable to an improper path parsing.
CVSS 3.0MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.01067 · Published 2018-08-15 · Fixed CWE-22
Priority LOW 27
A flaw was found in foreman from versions 1.18.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01074 · Published 2018-10-12 · Fixed CWE-79
Priority LOW 26
A cross-site scripting (XSS) flaw was found in the katello component of Satellite.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00999 · Published 2019-01-13 · Fixed in 3.9.0 CWE-79
THREATIST.IORead the docs