Description
A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.14.0.14-1.el9sat | RHSA-2026:5970, RHSA-2026:5968 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.17.7-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite Maintenance 6 | libcomps +1 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | dynflow-utils | 2.0.1-1.el9sat | RHSA-2026:22326 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.14.0.14-1.el9sat | RHSA-2026:5970, RHSA-2026:5968 |
| Red Hat Satellite Capsule 6 | libcomps +2 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-brotli +1 | 1.2.0-0.1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-django +1 | 4.2.28-0.1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-pulp-container +1 | 2.22.3-1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.27.10-2.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | rubygem-rubyipmi | 0.13.0-1.el9sat | RHSA-2026:5970, RHSA-2026:5968 |
| Red Hat Satellite Capsule 6 | satellite +3 | 6.17.7-1.el9sat | RHSA-2026:5970 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite 6 | dynflow-utils | 2.0.1-1.el9sat | RHSA-2026:22326 |
| Red Hat Satellite 6 | foreman +14 | 3.14.0.14-1.el9sat | RHSA-2026:5970, RHSA-2026:5968 |
| Red Hat Satellite 6 | libcomps +2 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | python-brotli +1 | 1.2.0-0.1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | python-django +1 | 4.2.28-0.1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | python-pulp-container +1 | 2.22.3-1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | python-pulp-rpm +1 | 3.27.10-2.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-fog-kubevirt | 1.5.1-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-foreman_kubevirt | 0.4.3-1.el9sat | RHSA-2026:5970, RHSA-2026:5968 |
| Red Hat Satellite 6 | rubygem-katello | 4.16.0.14-1.el9sat | RHSA-2026:22326, RHSA-2026:5970, RHSA-2026:5968 |
| Red Hat Satellite 6 | rubygem-rubyipmi | 0.13.0-1.el9sat | RHSA-2026:5970, RHSA-2026:5968 |
| Red Hat Satellite 6 | satellite +3 | 6.17.7-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-4.el9sat | RHSA-2026:5970, RHSA-2026:5968 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | katello | < 4.19.1 | 4.19.1 | GHSA-fwj4-6wgp-mpxm |
Advisories 4
- WID-SEC-2026-1007 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- RHSA-2026:5968 Red Hat Security Advisory: Satellite 6.18.4 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:22326 Red Hat Security Advisory: Satellite 6.19.1 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:5970 Red Hat Security Advisory: Satellite 6.17.7 Async Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
References
- RHSA-2026:22326 vendor-advisory
- RHSA-2026:5968 vendor-advisory
- RHSA-2026:5970 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-4324 vdb-entry
- RHBZ#2448349 issue-tracking