Description
A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Satellite | 5.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | satellite-schema | 5.8.0.33-1.el6sat | RHSA-2017:2645 |
| Red Hat Network Satellite 5 | spacewalk-backend +17 | 2.5.3-151.el6sat | RHSA-2017:2645 |
| Red Hat Network Satellite 5 | spacewalk-java +5 | 2.5.14-95.el6sat | RHSA-2017:2645 |
| Red Hat Network Satellite 5 | spacewalk-schema | 2.5.1-50.el6sat | RHSA-2017:2645 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server 3.1 | cobbler | 2.6.6-5.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | jabberd | 2.6.1-3.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | osad | 5.11.80.3-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | rhnpush | 5.5.104.3-2.3.2 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | salt-netapi-client | 0.12.0-3.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | smdba | 1.5.8-0.2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | spacecmd | 2.7.8.6-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | spacewalk-backend | 2.7.73.7-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | spacewalk-branding | 2.7.2.7-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | spacewalk-certs-tools | 2.7.0.7-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | spacewalk-java | 2.7.46.5-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | spacewalk-search | 2.7.3.2-2.3.4 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | spacewalk-utils | 2.7.10.5-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | spacewalk-web | 2.7.1.10-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | susemanager | 3.1.8-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | susemanager-docs_en | 3-10.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | susemanager-schema | 3.1.9-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.1 | susemanager-sync-data | 3.1.6-2.3.1 | SUSE-SU-2017:2257-1 |
| SUSE Manager Server 3.0 | salt-netapi-client | 0.12.0-16.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | smdba | 1.6.0-0.7.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | spacewalk-backend | 2.5.24.13-26.8.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | spacewalk-branding | 2.5.2.14-16.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | spacewalk-config | 2.5.2.8-13.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | spacewalk-java | 2.5.59.17-27.6.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | spacewalk-search | 2.5.2.3-4.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | spacewalk-setup-jabberd | 2.5.0.3-2.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | spacewalk-web | 2.5.7.18-25.6.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | susemanager | 3.0.23-25.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | susemanager-docs_en | 3-25.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | susemanager-schema | 3.0.21-25.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | susemanager-sync-data | 3.0.18-28.3.1 | SUSE-SU-2017:2453-1 |
| SUSE Manager Server 3.0 | virtual-host-gatherer | 1.0.14-7.3.1 | SUSE-SU-2017:2453-1 |
Advisories 3
- RHSA-2017:2645 Red Hat Security Advisory: satellite and spacewalk security and bug fix update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- SUSE-SU-2017:2257-1 Security update for SUSE Manager Server 3.1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2453-1 Security update for SUSE Manager Server 3.0 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7538
- 1039267 vdb-entry
- RHSA-2017:2645 vendor-advisory