Red Hat Security AdvisoryRHSA-2023:5980
Satellite 6.11.5.6 async security update
Released 2023-10-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.11 for RHEL 7 foreman-3.1.1.27-1.el7sat, foreman-cli-3.1.1.27-1.el7sat, foreman-debug-3.1.1.27-1.el7sat +14
- Red Hat Satellite 6.11 for RHEL 8 foreman-3.1.1.27-1.el8sat, foreman-cli-3.1.1.27-1.el8sat, foreman-debug-3.1.1.27-1.el8sat +14
Fixes 8 records
Priority CRITICAL 93
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.96391 · Published 2022-06-21 · Partial fix CWE-78
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority CRITICAL 90
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.82612 · Published 2022-05-03 · Partial fix CWE-78
Priority MEDIUM 44
An arbitrary code execution flaw was found in Foreman.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.01382 · Published 2023-09-20 · Fixed in 3.1.1.27-1.el7sat, 3.1.1.27-1.el8sat +2 CWE-78
Priority MEDIUM 43
An arbitrary code execution flaw was found in Foreman.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00961 · Published 2023-09-20 · Fixed CWE-94
Priority MEDIUM 43
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01422 · Published 2023-01-17 · Fixed in v1.13.0, 1.13.0 CWE-94
Priority MEDIUM 40
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01414 · Published 2023-01-17 · Fixed in v1.13.0, 1.13.0 CWE-94
Priority LOW 39
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03796 · Published 2023-10-11 · Partial fix · 1.20.10, 1.21.3 +1 CWE-770
THREATIST.IORead the docs