Multiple vulnerabilities in Red Hat Satellite 6.11
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU64862
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-30122
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when parsing multipart POST requests. A remote attacker can send specially crafted multipart POST requests to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Satellite: 6.11.0 - 6.11.3
foreman-proxy (Red Hat package): 3.1.1.1-1.el7sat - 3.1.1.1-1.el8sat
foreman (Red Hat package): 3.1.1.21-2.el7sat - 3.1.1.21-2.el8sat
ansible-collection-redhat-satellite (Red Hat package): 3.3.0-1.el7sat - 3.3.0-1.el8sat
tfm-rubygem-katello (Red Hat package): 3.4.5.58-1.el7sat - 4.1.1.55-1.el7sat
satellite (Red Hat package): 6.2.0-21.1.el7sat - 6.10.5-1.el7sat
tfm-rubygem-tzinfo (Red Hat package): 1.2.6-1.el7sat
tfm-rubygem-smart_proxy_ansible (Red Hat package): 3.0.1-6.el7sat
tfm-rubygem-rack (Red Hat package): 2.2.3-1.el7sat
tfm-rubygem-foreman_webhooks (Red Hat package): before 2.0.3-1.el7sat
rubygem-tzinfo (Red Hat package): before 1.2.10-1.el8sat
rubygem-smart_proxy_ansible (Red Hat package): before 3.3.1-4.el8sat
rubygem-rack (Red Hat package): before 2.2.3.1-1.el8sat
rubygem-katello (Red Hat package): before 4.3.0.50-1.el8sat
rubygem-foreman_webhooks (Red Hat package): before 2.0.3-1.el8sat
rubygem-foreman_maintain (Red Hat package): before 1.0.18-1.el8sat
External linkshttp://access.redhat.com/errata/RHSA-2022:7242
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Path traversal
EUVDB-ID: #VU68860
Risk: Medium
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2022-31163
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing a new line character in the TZInfo::Timezone.get. With Ruby version 1.9.3 and later, TZInfo::Timezone.get can be made to load unintended files with require, executing them within the Ruby process. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the system.
Exploitation example:
TZInfo::Timezone.get("foo\n/../../../../../../../../../../../../../../../../tmp/payload")Mitigation
Install updates from vendor's website.
Red Hat Satellite: 6.11.0 - 6.11.3
foreman-proxy (Red Hat package): 3.1.1.1-1.el7sat - 3.1.1.1-1.el8sat
foreman (Red Hat package): 3.1.1.21-2.el7sat - 3.1.1.21-2.el8sat
ansible-collection-redhat-satellite (Red Hat package): 3.3.0-1.el7sat - 3.3.0-1.el8sat
tfm-rubygem-katello (Red Hat package): 3.4.5.58-1.el7sat - 4.1.1.55-1.el7sat
satellite (Red Hat package): 6.2.0-21.1.el7sat - 6.10.5-1.el7sat
tfm-rubygem-tzinfo (Red Hat package): 1.2.6-1.el7sat
tfm-rubygem-smart_proxy_ansible (Red Hat package): 3.0.1-6.el7sat
tfm-rubygem-rack (Red Hat package): 2.2.3-1.el7sat
tfm-rubygem-foreman_webhooks (Red Hat package): before 2.0.3-1.el7sat
rubygem-tzinfo (Red Hat package): before 1.2.10-1.el8sat
rubygem-smart_proxy_ansible (Red Hat package): before 3.3.1-4.el8sat
rubygem-rack (Red Hat package): before 2.2.3.1-1.el8sat
rubygem-katello (Red Hat package): before 4.3.0.50-1.el8sat
rubygem-foreman_webhooks (Red Hat package): before 2.0.3-1.el8sat
rubygem-foreman_maintain (Red Hat package): before 1.0.18-1.el8sat
External linkshttp://access.redhat.com/errata/RHSA-2022:7242
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
