Search for packages
| purl | pkg:gem/katello@2.4.0.rc1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-a82s-fzvq-57av
Aliases: CVE-2016-3072 GHSA-527r-mfmj-prqf |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') An input sanitization flaw was found in the scoped search parameters sort_by and sort_order in the REST API. An authenticated user could use this flaw to perform an SQL injection attack on the Katello back end database. |
Affected by 4 other vulnerabilities. |
|
VCID-asqu-5r9h-9yav
Aliases: CVE-2018-14623 GHSA-jx5v-788g-qw58 |
SQL Injection An SQL injection was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. |
Affected by 2 other vulnerabilities. |
|
VCID-bsbd-bsbq-7qdk
Aliases: CVE-2019-14825 GHSA-m4wh-848j-9w2r |
Katello cleartext password storage issue A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.2. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users. |
Affected by 1 other vulnerability. |
|
VCID-ftzy-9uny-byfb
Aliases: CVE-2018-16887 GHSA-mhhc-r88h-2qrm |
Cross-site Scripting A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before `3.9.0` are vulnerable. |
Affected by 3 other vulnerabilities. |
|
VCID-zqkc-zwfa-1qfx
Aliases: CVE-2026-4324 GHSA-fwj4-6wgp-mpxm |
Katello: Denial of Service and potential information disclosure via SQL injection A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||