Katello
Monthly
An authorization flaw in Katello's Flatpak Remote Repositories API allows an authenticated user who is permitted to view flatpak remotes in one organization to retrieve flatpak remote repository records - including the stored credentials for that remote - belonging to a different organization. The same unscoped lookup is reused by the mirror action, so a user with edit rights on a product in their own organization can create a repository configured with another organization's flatpak remote URL and its stored remote credentials. Exploitation requires an authenticated account holding the flatpak-remote view permission, the flatpak remote feature to be in active use, and a multi-organization Red Hat Satellite 6 / Katello deployment; no public exploit code has been identified at time of analysis, and the flaw is a medium-priority authenticated authorization issue rather than an emergency.
Cross-organization repository metadata disclosure in the Katello (Red Hat Satellite 6) Docker Tags repositories API allows an authenticated user who holds product-view permissions in one organization to retrieve repository configuration data for Docker meta tags owned by a different organization by simply supplying that foreign tag identifier. The weakness is an authorization-scoping gap (CWE-639, IDOR-style) correctly rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with impact limited to low-severity confidentiality loss - there is no write or denial-of-service effect. Exploitation requires valid credentials, multi-organization deployment, and knowledge or enumeration of valid foreign tag identifiers; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not supplied.
A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection flaw was found in katello's errata-related API. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in content_search_controller.rb or (2) action parameter in the. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. Public exploit code available.
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 61.5%.
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
An authorization flaw in Katello's Flatpak Remote Repositories API allows an authenticated user who is permitted to view flatpak remotes in one organization to retrieve flatpak remote repository records - including the stored credentials for that remote - belonging to a different organization. The same unscoped lookup is reused by the mirror action, so a user with edit rights on a product in their own organization can create a repository configured with another organization's flatpak remote URL and its stored remote credentials. Exploitation requires an authenticated account holding the flatpak-remote view permission, the flatpak remote feature to be in active use, and a multi-organization Red Hat Satellite 6 / Katello deployment; no public exploit code has been identified at time of analysis, and the flaw is a medium-priority authenticated authorization issue rather than an emergency.
Cross-organization repository metadata disclosure in the Katello (Red Hat Satellite 6) Docker Tags repositories API allows an authenticated user who holds product-view permissions in one organization to retrieve repository configuration data for Docker meta tags owned by a different organization by simply supplying that foreign tag identifier. The weakness is an authorization-scoping gap (CWE-639, IDOR-style) correctly rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with impact limited to low-severity confidentiality loss - there is no write or denial-of-service effect. Exploitation requires valid credentials, multi-organization deployment, and knowledge or enumeration of valid foreign tag identifiers; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not supplied.
A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection flaw was found in katello's errata-related API. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setup_utils function in content_search_controller.rb or (2) action parameter in the. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. Public exploit code available.
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 61.5%.
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.