Description
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | spacewalk-backend +17 | 1.2.13-66.1.el6sat | RHSA-2012:0436 |
Advisories 1
- RHSA-2012:0436 Red Hat Security Advisory: Red Hat Network Satellite spacewalk-backend security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- 81481 vdb-entry
- 1026873 vdb-entry
- 52832 vdb-entry
- network-satellite-null-sec-bypass(74498) vdb-entry
- 48664 third-party-advisory
- RHSA-2012:0436 vendor-advisory