Red Hat Satellite 6.

Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates

• Red Hat AMQ Broker 7
• Red Hat Build of Keycloak
• Weak cryptography or TLS

Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer

• Red Hat AMQ Broker 7
• Red Hat Build of Keycloak
• Weak cryptography or TLS

Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses

• Red Hat build of Apache Camel 4 for Quarkus 3
• Red Hat build of Apicurio Registry 3
• Information disclosure

Foreman: domain and subnet interface api skips host search filters

• Red Hat Satellite 6
• Broken access control

Foreman: api filter lookup ignores a search-limited filter permission

• Red Hat Satellite 6
• Broken access control

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

• Red Hat Migration Toolkit for Applications 8
• Red Hat Migration Toolkit for Virtualization
• Path traversal

Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

• Red Hat Hardened Images
• Red Hat Satellite 6
• Broken access control

Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass

• Red Hat Hardened Images
• Red Hat Satellite 6
• Broken access control

Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests

• Red Hat Satellite 6
• Authentication bypass

Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

• Red Hat Satellite 6
• Red Hat Update Infrastructure 4 for Cloud Providers
• Path traversal

Pulp-ansible: bearer tokens are reused across remotes in a worker

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• CWE-488

Pulp-container: registry credentials are reused across remotes in a worker

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• CWE-488

Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

• Red Hat Satellite 6
• Broken access control

Rubygem-katello: improper authorization logic allows resource enumeration

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Information disclosure

Rubygem-katello: sql injection in registry proxy via labels

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• SQL injection

Foreman: command injection in foreman-tail

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Command injection

Rubygem-hammer_cli: command injection via insecure editor invocation

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Command injection

Foreman: ssti and insecure deserialization in foreman-rake configuration

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Insecure deserialization

Foreman: command injection in foreman-rake database tasks

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Command injection

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Command injection

Foreman: unauthenticated information disclosure via provisioning token validation flaw

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Authentication bypass

Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Command injection

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.6
• Path traversal

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

• Red Hat
• Red Hat build of Quarkus 3.27.6.redhat
• CWE-346
• CWE-942

Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

• Red Hat Satellite 6
• Broken access control

Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters

• Red Hat Satellite 6
• Broken access control

Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction

• Red Hat Satellite 6
• Broken access control

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• Cross-site scripting (XSS)

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

• Red Hat Build of Apache Camel 3.33.3.SP1
• Red Hat build of Keycloak 26.6
• XML external entities (XXE)

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-129

Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup

• Red Hat Satellite 6
• Broken access control

Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

• Red Hat Satellite 6
• Broken access control

Ketello: katello content view history api cross-organization authorization bypass

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Broken access control

Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives

• Pen Drive Powered by Red Hat Lightspeed
• Red Hat Certification Program for Red Hat Enterprise Linux 9
• Information disclosure

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

• OpenSUSE libsolv
• Red Hat Enterprise Linux 10
• Memory corruption

Foreman: foreman: information disclosure via improper validation of nested request parameters

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Broken access control

Foreman: foreman: unauthorized modification of host configurations via broken access control

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Broken access control

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Broken access control

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Privilege escalation

Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config

• Red Hat Satellite 6
• Server-side request forgery (SSRF)

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Forman: foreman: remote code execution via command injection in websocket proxy

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Command injection

Foreman: os command injection via ct_location and fcct_location parameters

• Foreman
• Red Hat Satellite 6.15 for RHEL 8
• Command injection

Foreman: disclosure of executed commands and outputs in foreman / red hat satellite

• Red Hat Satellite Server
• Red Hat Satellite 6
• Information disclosure

Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

• Red Hat Satellite 6.12 for RHEL 8
• Red Hat Satellite 6
• Information disclosure

Foreman: command injection in "host init config" template via "install packages" field on foreman

• Red Hat Satellite 6
• Command injection

Katello: potential cross-site scripting exploit in ui

• Red Hat Satellite 6
• Cross-site scripting (XSS)

Foreman-installer: candlepin database password being leaked to local users via the process list

• Red Hat Satellite 6
• Information disclosure

Improper authorization check in the server component

• candlepin-4.3.7
• candlepin-4.3.8
• Broken access control

Arbitrary code execution through yaml global parameters

• foreman
• Red Hat Satellite 6
• Code injection

Red Hat Satellite 6: Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF…

• Red Hat Satellite 6

Rhn-proxy: rhn-satellite: rhn-proxy: information disclosure via clear-text credential transmission when accessing rhn satellite

• Red Hat Satellite Proxy v 5.6
• Red Hat Satellite 6
• Weak cryptography or TLS

Red hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypass

• Red Hat Network Satellite Server v 5.3
• Red Hat Network Satellite Server v 5.4
• Authentication bypass

Satellite: xss in custom system information key handling

• Red Hat Network Satellite Server v 5.4
• Red Hat Satellite 6
• Cross-site scripting (XSS)