Description
Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | spacewalk-java +5 | 2.3.8-134.el6sat | RHSA-2016:0590 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager 2.1 | cobbler | 2.2.2-0.61.2 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | osad | 5.11.33.11-15.2 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | rhnlib | 2.5.69.8-11.2 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | spacewalk-backend | 2.1.55.25-24.5 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | spacewalk-branding | 2.1.33.16-18.2 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | spacewalk-certs-tools | 2.1.6.10-18.3 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | spacewalk-java | 2.1.165.23-20.1 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | spacewalk-utils | 2.1.27.15-12.7 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | suseRegisterInfo | 2.1.12-14.2 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | susemanager | 2.1.24-23.1 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | susemanager-sync-data | 2.1.15-30.2 | SUSE-SU-2016:1367-1 |
| SUSE Manager 2.1 | susemanager-tftpsync | 2.1.2-11.2 | SUSE-SU-2016:1367-1 |
Advisories 2
- RHSA-2016:0590 Red Hat Security Advisory: spacewalk-java security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- SUSE-SU-2016:1367-1 Security update for SUSE Manager Server 2.1 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2016:0590 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1181472
- https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744
- https://bugzilla.redhat.com/show_bug.cgi?id=1315398
- https://bugzilla.redhat.com/show_bug.cgi?id=1314906
- https://bugzilla.redhat.com/show_bug.cgi?id=1181152
- https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794