Origin validation error in Red Hat Network Satellite Server v 5.4
Priority LOW 32CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Security bypass, Tampering
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-346 and CWE-352.
Summary
A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.
Why it matters now
EPSS 0.00882 59th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Network Satellite Server v 5.4 | — | 1.2.39-85.el5sat | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
- Red Hat Network Satellite Server v 5.4 VendorRed Hat Affected — Fixed in 1.2.39-85.el5sat Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:network_satellite_server:5.3.0:*:*:*:*:*:*:* | 5.3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:network_satellite_server:5.4.0:*:*:*:*:*:*:* | 5.4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:network_satellite_server:5.4.1:*:*:*:*:*:*:* | 5.4.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:spacewalk-java:1.2.39:*:*:*:*:*:*:* | 1.2.39 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:network_satellite_server:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:network_satellite_server:5.4.0:*:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:network_satellite_server:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:spacewalk-java:1.2.39:*:*:*:*:*:*:* Versions 1.2.39 Vulnerable ·Red Hat
Remediation
Red Hat 1 advisory
- RHSA-2011:0879 Released 2011-06-16 · Red Hat rating ModerateRed Hat Network Satellite server spacewalk-java security update
- Red Hat Satellite 5.4 (RHEL v.5) spacewalk-java-1.2.39-85.el5sat, spacewalk-java-config-1.2.39-85.el5sat, spacewalk-java-lib-1.2.39-85.el5sat +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 5.4 (RHEL v.5) | Fixed | RHSA-2011:0879 |
Timeline
- 2026-10-02 Threatist record created from CVE-2009-4139
- 2026-10-03 Alias added: GHSA-pvxx-xvvp-hc24
- 2026-10-30 Fix available: spacewalk-java@0:1.2.39-85.el5sat · CNA
- 2026-10-30 1 new reference · CNA
- 2026-10-30 Fix available: Red Hat Satellite 5.4 (RHEL v.5) · Red Hat
References
More Red Hat Network Satellite Server vulnerabilities
- TI-2009-00750 Red Hat Network (RHN) Satellite Server 5.3 and 5.4 does not properly rewrite unspecified… CVSS 2.0MEDIUM 6.4
- TI-2011-00625 Session fixation vulnerability in Red Hat Network (RHN) Satellite Server 5.4 allows… CVSS 2.0MEDIUM 5.8
- TI-2011-00626 Red Hat Network (RHN) Satellite Server 5.4 does not use a time delay after a failed login… CVSS 2.0MEDIUM 5.8
Sources
- CVE-2009-4139 · CVE Program
- CVE-2009-4139 · NVD
- FIRST EPSS
- GHSA-pvxx-xvvp-hc24 · GitHub Advisory Database · CC BY 4.0
- CVE-2009-4139 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences