Multiple vulnerabilities in Red Hat Satellite 6.13 for RHEL 8

1) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU83505

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-4130

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of HTTP Referer header at "/locations/clear". A remote authenticated user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 8.0

satellite (Red Hat package): before 6.13.7-1.el8sat

rubygem-katello (Red Hat package): before 4.7.0.36-1.el8sat

rubygem-foreman_leapp (Red Hat package): before 0.1.13-2.el8sat

rubygem-foreman_bootdisk (Red Hat package): before 21.0.5-1.el8sat

python-pulp-rpm (Red Hat package): before 3.18.19-2.el8pc

foreman-installer (Red Hat package): before 3.5.2.7-1.el8sat

foreman (Red Hat package): before 3.5.1.24-1.el8sat

ansible-collection-redhat-satellite (Red Hat package): before 3.9.0-3.el8sat

python-pulp-container (Red Hat package): before 2.14.11-1.el8pc

mosquitto (Red Hat package): before 2.0.17-1.el8sat

createrepo_c (Red Hat package): before 1.0.2-2.el8pc

satellite-clone (Red Hat package): before 3.5.0-1.el8sat

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-katello_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_leapp_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_bootdisk_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-rpm_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman-installer_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ansible-collection-redhat-satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-container_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:mosquitto_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:createrepo_c_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:satellite-clone_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2024:1061

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU79937

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-0809

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send malicious initial packets that are not CONNECT packets, trigger memory exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 8.0

satellite (Red Hat package): before 6.13.7-1.el8sat

rubygem-katello (Red Hat package): before 4.7.0.36-1.el8sat

rubygem-foreman_leapp (Red Hat package): before 0.1.13-2.el8sat

rubygem-foreman_bootdisk (Red Hat package): before 21.0.5-1.el8sat

python-pulp-rpm (Red Hat package): before 3.18.19-2.el8pc

foreman-installer (Red Hat package): before 3.5.2.7-1.el8sat

foreman (Red Hat package): before 3.5.1.24-1.el8sat

ansible-collection-redhat-satellite (Red Hat package): before 3.9.0-3.el8sat

python-pulp-container (Red Hat package): before 2.14.11-1.el8pc

mosquitto (Red Hat package): before 2.0.17-1.el8sat

createrepo_c (Red Hat package): before 1.0.2-2.el8pc

satellite-clone (Red Hat package): before 3.5.0-1.el8sat

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-katello_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_leapp_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_bootdisk_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-rpm_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman-installer_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ansible-collection-redhat-satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-container_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:mosquitto_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:createrepo_c_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:satellite-clone_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2024:1061

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU79936

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28366

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote user to perform DoS attack on the target system.

The vulnerability exists due memory leak in broker. A remote client can send multiple QoS 2 messages with the same message ID, but then never respond to the PUBREC commands, which results in memory leak and denial of service condition.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 8.0

satellite (Red Hat package): before 6.13.7-1.el8sat

rubygem-katello (Red Hat package): before 4.7.0.36-1.el8sat

rubygem-foreman_leapp (Red Hat package): before 0.1.13-2.el8sat

rubygem-foreman_bootdisk (Red Hat package): before 21.0.5-1.el8sat

python-pulp-rpm (Red Hat package): before 3.18.19-2.el8pc

foreman-installer (Red Hat package): before 3.5.2.7-1.el8sat

foreman (Red Hat package): before 3.5.1.24-1.el8sat

ansible-collection-redhat-satellite (Red Hat package): before 3.9.0-3.el8sat

python-pulp-container (Red Hat package): before 2.14.11-1.el8pc

mosquitto (Red Hat package): before 2.0.17-1.el8sat

createrepo_c (Red Hat package): before 1.0.2-2.el8pc

satellite-clone (Red Hat package): before 3.5.0-1.el8sat

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-katello_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_leapp_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_bootdisk_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-rpm_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman-installer_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ansible-collection-redhat-satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-container_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:mosquitto_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:createrepo_c_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:satellite-clone_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2024:1061

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU79938

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-3592

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when processing v5 CONNECT packets. A remote attacker can force the application to leak memory by sending messages with invalid property types.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 8.0

satellite (Red Hat package): before 6.13.7-1.el8sat

rubygem-katello (Red Hat package): before 4.7.0.36-1.el8sat

rubygem-foreman_leapp (Red Hat package): before 0.1.13-2.el8sat

rubygem-foreman_bootdisk (Red Hat package): before 21.0.5-1.el8sat

python-pulp-rpm (Red Hat package): before 3.18.19-2.el8pc

foreman-installer (Red Hat package): before 3.5.2.7-1.el8sat

foreman (Red Hat package): before 3.5.1.24-1.el8sat

ansible-collection-redhat-satellite (Red Hat package): before 3.9.0-3.el8sat

python-pulp-container (Red Hat package): before 2.14.11-1.el8pc

mosquitto (Red Hat package): before 2.0.17-1.el8sat

createrepo_c (Red Hat package): before 1.0.2-2.el8pc

satellite-clone (Red Hat package): before 3.5.0-1.el8sat

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-katello_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_leapp_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_bootdisk_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-rpm_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman-installer_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ansible-collection-redhat-satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-container_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:mosquitto_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:createrepo_c_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:satellite-clone_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2024:1061

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Incorrect default permissions

EUVDB-ID: #VU84616

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-4886

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software sets world readable permissions to file /etc/tomcat/server.xml, which contains passwords to candlepin's keystore and truststore. A local user can gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 8.0

satellite (Red Hat package): before 6.13.7-1.el8sat

rubygem-katello (Red Hat package): before 4.7.0.36-1.el8sat

rubygem-foreman_leapp (Red Hat package): before 0.1.13-2.el8sat

rubygem-foreman_bootdisk (Red Hat package): before 21.0.5-1.el8sat

python-pulp-rpm (Red Hat package): before 3.18.19-2.el8pc

foreman-installer (Red Hat package): before 3.5.2.7-1.el8sat

foreman (Red Hat package): before 3.5.1.24-1.el8sat

ansible-collection-redhat-satellite (Red Hat package): before 3.9.0-3.el8sat

python-pulp-container (Red Hat package): before 2.14.11-1.el8pc

mosquitto (Red Hat package): before 2.0.17-1.el8sat

createrepo_c (Red Hat package): before 1.0.2-2.el8pc

satellite-clone (Red Hat package): before 3.5.0-1.el8sat

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-katello_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_leapp_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:rubygem-foreman_bootdisk_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-rpm_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman-installer_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:foreman_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ansible-collection-redhat-satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:python-pulp-container_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:mosquitto_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:createrepo_c_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:satellite-clone_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2024:1061

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.