Red Hat Satellite 6.0

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote code execution (RCE) on the system.

Published: 2026-02-27T07:30:42.657Z
Updated: 2026-03-26T23:10:23.847Z

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script.

Published: 2024-08-12T16:48:54.120Z
Updated: 2025-11-20T20:56:57.209Z

A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections.

Published: 2024-06-05T15:06:13.886Z
Updated: 2025-11-20T19:15:48.050Z

A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.

Published: 2024-06-05T15:05:37.869Z
Updated: 2025-11-21T06:41:06.458Z

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

Published: 2023-11-14T22:57:00.584Z
Updated: 2025-11-20T17:30:17.896Z