Description
A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | foreman | < 3.3 | 3.3 |
| Red Hat | Red Hat Satellite 6.12 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | candlepin +1 | 4.1.15-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | foreman +13 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-git | 1.11.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-rails-html-sanitizer | 1.4.3-2.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
Advisories 1
- RHSA-2022:8506 Red Hat Security Advisory: Satellite 6.12 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026