Read the docs
TI-2019-02857 Aliases CVE-2019-3845GHSA-rcf7-8mg9-v2ww

Improper access control in Red Hat qpid-dispatch-router

Priority LOW 36CWE-284Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.

Summary

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

Why it matters now

EPSS 0.00679 52nd percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatqpid-dispatch-routerfixed in Satellite >= 6.2; fixed in Satellite 6.1 - Optional; fixed in Satellite Capsule 6.1—No fix listedCNA
  • qpid-dispatch-router VendorRed Hat Affected fixed in Satellite >= 6.2; fixed in Satellite 6.1 - Optional; fixed in Satellite Capsule 6.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*before 6.2VulnerableRed Hat
  • cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:* Versions before 6.2 Vulnerable ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2019:1223 Released 2019-05-14 · Red Hat rating Important
    Red Hat Satellite Tools security update
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat, katello-host-tools-3.5.0-2.el7sat +7
    • Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat, katello-host-tools-3.5.0-2.el7sat +10
    • Satellite Tools 6.5 (v. 5.9.AUS Server) gofer-2.11.9-1.el5, katello-agent-3.5.0-2.el5, katello-host-tools-3.5.0-2.el5 +20
    • Satellite Tools 6.5 (v. 5.9.ELS Server) gofer-2.11.9-1.el5, katello-agent-3.5.0-2.el5, katello-host-tools-3.5.0-2.el5 +20
    • Satellite Tools 6.5 (v. 6 Client) gofer-2.11.9-1.el6sat, katello-agent-3.5.0-2.el6sat, katello-host-tools-3.5.0-2.el6sat +16
    • Satellite Tools 6.5 (v. 6 ComputeNode) gofer-2.11.9-1.el6sat, katello-agent-3.5.0-2.el6sat, katello-host-tools-3.5.0-2.el6sat +16
    • Satellite Tools 6.5 (v. 6 Server) gofer-2.11.9-1.el6sat, katello-agent-3.5.0-2.el6sat, katello-host-tools-3.5.0-2.el6sat +16
    • Satellite Tools 6.5 (v. 6 Workstation) gofer-2.11.9-1.el6sat, katello-agent-3.5.0-2.el6sat, katello-host-tools-3.5.0-2.el6sat +16
    • Satellite Tools 6.5 (v. 6.4.AUS Server) katello-host-tools-3.5.0-2.el6sat, katello-host-tools-fact-plugin-3.5.0-2.el6sat, openscap-1.2.4-2.el6 +5
    • Satellite Tools 6.5 (v. 6.5.AUS Server) katello-host-tools-3.5.0-2.el6sat, katello-host-tools-fact-plugin-3.5.0-2.el6sat, openscap-1.2.4-2.el6 +5
    • Satellite Tools 6.5 (v. 6.6.AUS Server) katello-host-tools-3.5.0-2.el6sat, katello-host-tools-fact-plugin-3.5.0-2.el6sat, openscap-1.2.4-2.el6 +5
    • Satellite Tools 6.5 (v. 7 Client) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +20
    • Satellite Tools 6.5 (v. 7 ComputeNode) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +20
    • Satellite Tools 6.5 (v. 7 Server) foreman-1.20.1.34-1.el7sat, foreman-cli-1.20.1.34-1.el7sat, future-0.16.0-11.el7sat +47
    • Satellite Tools 6.5 (v. 7 Workstation) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +20
    • Satellite Tools 6.5 (v. 7.2.AUS Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.2.E4S Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.2.TUS Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.3.AUS Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.3.E4S Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.3.TUS Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.4.AUS Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.4.E4S Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.4.EUS ComputeNode) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +20
    • Satellite Tools 6.5 (v. 7.4.EUS Server) foreman-1.20.1.34-1.el7sat, foreman-cli-1.20.1.34-1.el7sat, future-0.16.0-11.el7sat +47
    • Satellite Tools 6.5 (v. 7.4.TUS Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.5.EUS ComputeNode) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +20
    • Satellite Tools 6.5 (v. 7.5.EUS Server) foreman-1.20.1.34-1.el7sat, foreman-cli-1.20.1.34-1.el7sat, future-0.16.0-11.el7sat +47
    • Satellite Tools 6.5 (v. 7.6.AUS Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.6.E4S Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 7.6.EUS Compute Node) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +20
    • Satellite Tools 6.5 (v. 7.6.EUS Server) foreman-1.20.1.34-1.el7sat, foreman-cli-1.20.1.34-1.el7sat, future-0.16.0-11.el7sat +47
    • Satellite Tools 6.5 (v. 7.6.TUS Server) future-0.16.0-11.el7sat, gofer-2.12.5-3.el7sat, katello-agent-3.5.0-2.el7sat +26
    • Satellite Tools 6.5 (v. 8) future-0.16.0-11.el8sat, gofer-2.12.5-3.el8sat, katello-agent-3.5.0-2.el8sat +17
    • Satellite Tools 6.5 (v. RHEL-ALT 7.6 Server) gofer-2.12.5-3.el7sat, python-gofer-2.12.5-3.el7sat, python-gofer-proton-2.12.5-3.el7sat +3
  • RHSA-2019:0734 Released 2019-04-09 · Red Hat rating Important
    katello-installer-base security and enhancement update
    • Red Hat Satellite 6.2 foreman-installer-katello-3.0.0.105-1.el6sat, foreman-installer-katello-3.0.0.105-1.el7sat, katello-installer-base-3.0.0.105-1.el6sat +47
    • Red Hat Satellite Capsule 6.2 foreman-installer-katello-3.0.0.105-1.el6sat, foreman-installer-katello-3.0.0.105-1.el7sat, katello-installer-base-3.0.0.105-1.el6sat +37
  • RHSA-2019:0735 Released 2019-04-09 · Red Hat rating Important
    katello-installer-base security and enhancement update
    • Red Hat Satellite 6.4 katello-installer-base-3.7.0.19-1.el7sat
    • Red Hat Satellite Capsule 6.4 katello-installer-base-3.7.0.19-1.el7sat
Show 1 more Red Hat advisories
  • RHSA-2019:0733 Released 2019-04-09 · Red Hat rating Important
    katello-installer-base security and enhancement update
    • Red Hat Satellite 6.3 foreman-installer-katello-3.4.5.35-1.el7sat, katello-installer-base-3.4.5.35-1.el7sat, satellite-6.3.5.1-1.el7sat +4
    • Red Hat Satellite Capsule 6.3 foreman-installer-katello-3.4.5.35-1.el7sat, katello-installer-base-3.4.5.35-1.el7sat, satellite-6.3.5.1-1.el7sat +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6.2Fixed RHSA-2019:0734
Red Hat Satellite 6.3Fixed RHSA-2019:0733
Red Hat Satellite 6.4Fixed RHSA-2019:0735
Red Hat Satellite Capsule 6.2Fixed RHSA-2019:0734
Red Hat Satellite Capsule 6.3Fixed RHSA-2019:0733
Red Hat Satellite Capsule 6.4Fixed RHSA-2019:0735
Not affected: 2 products
  • Red Hat Satellite 6.4
  • Red Hat Satellite Capsule 6.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3845
  2. 2026-10-03 Alias added: GHSA-rcf7-8mg9-v2ww

References

Advisory 2

  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-35991 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks KEVCVSS 3.1MEDIUM 6.5
  • TI-2015-04118 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers… KEVCVSS 3.1MEDIUM 5.3
  • TI-2018-07743 It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface… CVSS 3.0CRITICAL 9.8
See all 242 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences