Search for packages
| purl | pkg:gem/katello@2.4.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-a82s-fzvq-57av
Aliases: CVE-2016-3072 GHSA-527r-mfmj-prqf |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') An input sanitization flaw was found in the scoped search parameters sort_by and sort_order in the REST API. An authenticated user could use this flaw to perform an SQL injection attack on the Katello back end database. |
Affected by 3 other vulnerabilities. |
|
VCID-asqu-5r9h-9yav
Aliases: CVE-2018-14623 GHSA-jx5v-788g-qw58 |
SQL Injection An SQL injection was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. |
Affected by 1 other vulnerability. |
|
VCID-bsbd-bsbq-7qdk
Aliases: CVE-2019-14825 GHSA-m4wh-848j-9w2r |
Katello cleartext password storage issue A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.2. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users. |
Affected by 0 other vulnerabilities. |
|
VCID-ftzy-9uny-byfb
Aliases: CVE-2018-16887 GHSA-mhhc-r88h-2qrm |
Cross-site Scripting A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before `3.9.0` are vulnerable. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||