Red Hat Enhancement Advisory: Release of Satellite 6.0

Fixed packages 66

Vulnerabilities 24

• Medium 5.9
  CVE-2014-4616

  simplejson before 2.6.1 vulnerable to array index error

  Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode functio…

  python3.4 python2.7 python2.7 python2 Debian Ubuntu Alpine PyPI
  Aug 24, 2017
• Unscored —
  CVE-2012-6619

  The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users t…

  Mar 6, 2014
• Unscored —
  CVE-2013-2101

  Katello has multiple XSS issues in various entities

  Katello Katello
  Dec 3, 2019
• Unscored —
  CVE-2013-2121 Public exploit EPSS 25%

  Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote…

  Jul 31, 2013
• Unscored —
  CVE-2013-2882

  Google V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a denial of service or possib…

  libv8-3.14 Ubuntu
  Jul 30, 2013
• Unscored —
  CVE-2013-4180

  The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a…

  Sep 16, 2013
• Unscored —
  CVE-2013-4182

  app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which al…

  Sep 16, 2013
• Unscored —
  CVE-2013-4201

  Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remo…

  May 1, 2018
• Unscored —
  CVE-2013-4225

  The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly…

  RESTful Web Services RESTful Web Services
  Feb 11, 2020
• Unscored —
  CVE-2013-4386

  Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attac…

  Nov 19, 2013
• Unscored —
  CVE-2013-6639

  The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Googl…

  Dec 7, 2013
• Unscored —
  CVE-2013-6640

  The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Googl…

  libv8-3.14 Ubuntu
  Dec 7, 2013
• Unscored —
  CVE-2013-6650

  The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrom…

  chromium-browser libv8-3.14 Ubuntu
  Jan 28, 2014
• Unscored —
  CVE-2013-7440

  The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wild…

  python-py python2.7 Debian Azure Linux
  Jun 7, 2016
• Unscored —
  CVE-2014-0007 Public exploit

  The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands vi…

  Jun 20, 2014
• Unscored —
  CVE-2014-0089

  Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote a…

  Mar 27, 2014
• Unscored —
  CVE-2014-0090

  Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session i…

  May 8, 2014
• Unscored —
  CVE-2014-0091

  Foreman has improper input validation which could lead to partial Denial of Service

  Foreman foreman
  Dec 11, 2019
• Low —
  CVE-2014-0135

  Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml

  Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.

  kafo RubyGems
  May 8, 2014
• Unscored —
  CVE-2014-0192

  Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote att…

  May 8, 2014
• Unscored —
  CVE-2014-0208

  Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows rem…

  Oct 16, 2017
• Unscored —
  CVE-2014-0241

  rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable

  rubygem-hammer_cli_foreman rubygem-hammer_cli_foreman
  Dec 13, 2019
• Unscored —
  CVE-2014-1704

  Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, all…

  chromium-browser libv8-3.14 Ubuntu
  Mar 16, 2014
• Unscored —
  CVE-2014-3531

  Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject …

  Oct 18, 2017

References

• article
  https://access.redhat.com/site/documentation/
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1131602
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhea-2014_1175.json
• report
  https://access.redhat.com/security/cve/CVE-2012-6619
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1049748
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-6619
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-6619
• report
  https://access.redhat.com/security/cve/CVE-2013-2101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=963568
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-2101
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-2101
• report
  https://access.redhat.com/security/cve/CVE-2013-2121
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=968166
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-2121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-2121
• report
  https://access.redhat.com/security/cve/CVE-2013-2882
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=991116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-2882
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-2882
• report
  https://access.redhat.com/security/cve/CVE-2013-4180
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=989755
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4180
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4180
• report
  https://access.redhat.com/security/cve/CVE-2013-4182
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=990374
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4182
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4182
• report
  https://access.redhat.com/security/cve/CVE-2013-4201
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=991318
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4201
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4201
• report
  https://access.redhat.com/security/cve/CVE-2013-4225
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=997639
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4225
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4225
• report
  https://access.redhat.com/security/cve/CVE-2013-4386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1013076
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4386