katello

8 results · Feed

• Medium 4.3
  CVE-2026-12515

  Katello: missing repository authorization in content_uploads exposes cross-product content existence

  A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside th…

  Red Hat Red Hat Hardened Images Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 RubyGems
  Jun 17, 2026
• Medium 5.4
  CVE-2026-4324

  Rubygem-katello: katello: denial of service and potential information disclosure via sql injection

  A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API e…

  Red Hat Red Hat Satellite 6 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.18 for RHEL 9 RubyGems
  Mar 17, 2026
• Medium 4.1
  CVE-2019-14825

  Katello cleartext password storage issue

  A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials …

  Red Hat katello katello RubyGems
  Nov 25, 2019
• Medium 5.4
  CVE-2018-16887

  katello Cross-site Scripting vulnerability

  A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories…

  The Katello Project katello katello RubyGems
  Jan 13, 2019
• Medium 4.3
  CVE-2018-14623

  katello SQL Injection vulnerability

  A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2…

  The Foreman Project katello katello RubyGems
  Dec 13, 2018
• Medium 4.3
  CVE-2017-2662

  katello Improper Privilege Management vulnerability

  A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the reposito…

  The Foreman Project foreman katello plugin katello RubyGems
  Aug 22, 2018
• High 8.8
  CVE-2016-3072

  Katello SQL Injection vulnerabilities

  Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.

  katello RubyGems
  Jun 7, 2016
• Critical 9.8
  CVE-2012-3503

  Katello uses hard coded credential

  The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System…

  katello RubyGems
  Aug 25, 2012