A account takeover flaw was found in Red Hat Satellite 6.7.2 onward, a potential attacker with proper authentication to the relevant external authentication source (SSO or Open ID) can claim the privileges of already existing local users of Satellite.
Red Hat Satellite 6 allows local user of instance to read cache files. These credentials give full access via the API and local user on the foreman server can gain complete access of the instance.
Jan Hutař of Red Hat reports:
There is a XSS possible in discovery rule when you are entering filter and you use autocomplete functionality
Version-Release number of selected component (if applicable): satellite-6.3.0-18.0.beta.el7sat.noarch
A password leak was identified on Red Hat Satellite which will expose BMC password in plaintext through the compute host API.
A credential leak vulnerability was identified on Red Hat Satellite which will expose compute resources credential through VMs that are running on these resources in Satellite.
In Red Hat Satellite, the MongoDB database can be accessed by any malicious local user of the Satellite server and pulpdatabase content can be modified or deleted. Embedded MongoDB was introduced in Satellite 6.0 onward therefore, all the current Satellite active versions are affected by the flaw.
Nils Juenemann reported that there is a cross-site scripting flaw in the filter for a result set in nearly every filter form provided by Red Hat Satellite (for example the "Filter by Synopsis" field).
Acknowledgements:
Red Hat would like to thank Nils Juenemann and The Bearded Warriors for independently reporting this issue.
Nils Juenemann reported that there are cross-site scripting flaws in the various Search forms provided by Red Hat Satellite.
Acknowledgements:
Red Hat would like to thank Nils Juenemann for reporting this issue.
Red Hat Satellite was affected by an improper authentication in which few factors allow for someone to use the SCA (simple content access) certificate for authentication with Candlepin. The SCA certificates are purposed only for authorizing content access against the CDN (or Pulp in case of Satellite).
End of life: 5/31/2019, End of support: 2/21/2018, Latest version: 6.2.16
End of life: 5/31/2019, End of support: 2/21/2018, Latest version: 6.2.16
End of life: 1/31/2024, End of support: 11/30/2022, Latest version: 6.11.5.7
End of life: 1/31/2024, End of support: 11/30/2022, Latest version: 6.11.5.7
End of life: 5/31/2025, End of support: 5/31/2024, Latest version: 6.14.4.5
End of life: 5/31/2025, End of support: 5/31/2024, Latest version: 6.14.4.5
End of life: 11/30/2021, End of support: 10/31/2020, Latest version: 6.7.5
End of life: 11/30/2021, End of support: 10/31/2020, Latest version: 6.7.5
End of life: 10/31/2020, End of support: 10/31/2019, Latest version: 6.5.3
End of life: 10/31/2020, End of support: 10/31/2019, Latest version: 6.5.3
End of life: 11/30/2022, End of support: 11/30/2021, Latest version: 6.9.10
End of life: 11/30/2022, End of support: 11/30/2021, Latest version: 6.9.10
End of life: 2/21/2018, End of support: 8/12/2015, Latest version: 6.0.8
End of life: 2/21/2018, End of support: 8/12/2015, Latest version: 6.0.8
End of life: 5/14/2021, End of support: 4/30/2020, Latest version: 6.6.3
End of life: 5/14/2021, End of support: 4/30/2020, Latest version: 6.6.3
End of life: 5/31/2019, End of support: 10/30/2018, Latest version: 6.3.5
End of life: 11/30/2024, End of support: 11/30/2023, Latest version: 6.13.7.3
End of life: 5/31/2019, End of support: 10/30/2018, Latest version: 6.3.5
End of life: 11/30/2024, End of support: 11/30/2023, Latest version: 6.13.7.3
End of life: 4/30/2020, End of support: 5/31/2019, Latest version: 6.4.4