Description
A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Red Hat Satellite | As shipped in Red Hat Satellite 6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | satellite +1 | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | candlepin | 4.0.9-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | satellite | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-activerecord-session_store | 2.0.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-addressable | 2.8.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.3.2-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-rails +1 | 6.0.3.7-1.el7sat | RHSA-2021:4702 |
Advisories 1
- RHSA-2021:4702 Red Hat Security Advisory: Satellite 6.10 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026