Description
A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.13 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.14 for RHEL 8 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.5.1.24-1.el8sat | RHSA-2024:1061, RHSA-2023:7851 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.14.1-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | createrepo_c +3 | 1.0.2-2.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.5.1.24-1.el8sat | RHSA-2024:1061, RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | foreman-installer +1 | 1:3.7.0.5-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | mosquitto | 2.0.17-1.el8sat | RHSA-2024:1061 |
| Red Hat Satellite Capsule 6 | pulpcore-selinux | 2.0.0-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-django-import-export +1 | 3.1.0-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-gitpython +1 | 3.1.40-0.1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.19.11-2.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-pulpcore +1 | 3.22.19-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.18-0.1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_remote_execution_ssh | 0.10.2-2.el8sat | RHSA-2023:7851 |
| Red Hat Satellite Capsule 6 | satellite +2 | 6.14.1-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | createrepo_c +3 | 1.0.2-2.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | foreman +12 | 3.5.1.24-1.el8sat | RHSA-2024:1061, RHSA-2023:7851 |
| Red Hat Satellite 6 | foreman-installer +1 | 1:3.7.0.5-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | foreman-redis | 3.7.0.10-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | mosquitto | 2.0.17-1.el8sat | RHSA-2024:1061 |
| Red Hat Satellite 6 | pulpcore-selinux | 2.0.0-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-django-import-export +1 | 3.1.0-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-gitpython +1 | 3.1.40-0.1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-pulp-rpm +1 | 3.19.11-2.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-pulpcore +1 | 3.22.19-1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | python-urllib3 +1 | 1.26.18-0.1.el8pc | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-foreman_leapp | 1.1.0-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-foreman_remote_execution +1 | 10.1.2-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-katello | 4.9.0.18-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-rails +12 | 6.1.7.4-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | rubygem-smart_proxy_remote_execution_ssh | 0.10.2-2.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | satellite +2 | 6.14.1-1.el8sat | RHSA-2023:7851 |
| Red Hat Satellite 6 | satellite-convert2rhel-toolkit | 1.0.0-1.el8sat | RHSA-2023:7851 |
Advisories 2
- RHSA-2023:7851 Red Hat Security Advisory: Satellite 6.14.1 Async Security Update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:1061 Red Hat Security Advisory: Red Hat Satellite 6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2023:7851 vendor-advisory
- RHSA-2024:1061 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-4886 vdb-entry
- RHBZ#2230135 issue-tracking