Satellite

An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.

Published: 2023-12-18T13:43:07.747Z
Updated: 2025-11-20T18:27:27.972Z

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

Published: 2023-09-20T13:40:43.213Z
Updated: 2024-09-24T15:05:20.612Z

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.

Published: 2023-09-20T13:39:27.756Z
Updated: 2024-09-17T13:51:28.373Z

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

Published: 2019-04-11T14:31:40.000Z
Updated: 2024-08-04T19:19:18.596Z

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions.

Published: 2019-01-22T15:00:00.000Z
Updated: 2024-08-05T09:38:13.123Z