Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | foreman | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | foreman-debug | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | foreman-pcp | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite Utils 6 satellite_utils:6.17::el9 | foreman | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite Utils 6 satellite_utils:6.17::el9 | foreman-cli | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-cli | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-debug | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-dynflow-sidekiq | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-ec2 | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-journald | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-libvirt | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-openstack | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-ovirt | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-pcp | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-postgresql | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-redis | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-service | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-telemetry | 0:3.14.0.11-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | foreman-vmware | 0:3.14.0.11-1.el9sat |
Vulnerabilities 1
-
Medium 5.0
Foreman: satellite: graphql api permission bypass leads to information disclosure
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an …
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2391715
-
article
https://issues.redhat.com/browse/SAT-40257
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21893.json
-
report
https://access.redhat.com/security/cve/CVE-2025-9572
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-9572
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-9572
-
article
https://theforeman.org/security.html#2025-9572