Description
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | spacewalk-java +4 | 1.2.39-137.el5sat | RHSA-2014:1184 |
| Red Hat Network Satellite 5 | spacewalk-java-postgresql | 2.0.2-85.el5sat | RHSA-2014:1184 |
Advisories 1
- RHSA-2014:1184 Red Hat Security Advisory: spacewalk-java security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 62027 third-party-advisory
- RHSA-2014:1184 vendor-advisory
- SUSE-SU-2014:1218 vendor-advisory
- SUSE-SU-2014:1339 vendor-advisory
- 61115 third-party-advisory