Description
An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.15 for RHEL 8 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | puppetserver | 7.14.0-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-aiohttp +1 | 3.9.2-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-django +1 | 4.2.9-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-galaxy-importer +1 | 0.4.19-2.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-jinja2 +1 | 3.1.3-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-pycryptodomex +1 | 3.20.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-pygments +1 | 2.17.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | rubygem-activesupport | 6.1.7.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | foreman +14 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | puppetserver | 7.14.0-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-aiohttp +1 | 3.9.2-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-django +1 | 4.2.9-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-galaxy-importer +1 | 0.4.19-2.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-jinja2 +1 | 3.1.3-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-pycryptodomex +1 | 3.20.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-pygments +1 | 2.17.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-activesupport | 6.1.7.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-audited | 5.4.2-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-puma | 6.4.2-1.el8sat | RHSA-2024:2010 |
Advisories 3
- RHSA-2024:2010 Red Hat Security Advisory: Satellite 6.15.0 release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0949 Red Hat Satellite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 26, 2026
- WID-SEC-2023-2060 Red Hat Satellite: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Aug 14, 2023
References
- RHSA-2024:2010 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-4320 vdb-entry
- RHBZ#2231814 issue-tracking