Multiple vulnerabilities in Red Hat Satellite 6.12
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2022-32224 CVE-2022-42889 |
| CWE-ID | CWE-502 CWE-94 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software |
Red Hat Satellite Server applications / Other server solutions Red Hat Enterprise Linux for x86_64 Operating systems & Components / Operating system satellite-clone (Red Hat package) Operating systems & Components / Operating system package or component satellite (Red Hat package) Operating systems & Components / Operating system package or component rubygem-smart_proxy_container_gateway (Red Hat package) Operating systems & Components / Operating system package or component rubygem-railties (Red Hat package) Operating systems & Components / Operating system package or component rubygem-rails (Red Hat package) Operating systems & Components / Operating system package or component rubygem-katello (Red Hat package) Operating systems & Components / Operating system package or component rubygem-foreman_webhooks (Red Hat package) Operating systems & Components / Operating system package or component rubygem-foreman_rh_cloud (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activesupport (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activestorage (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activerecord (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activemodel (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activejob (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actionview (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actiontext (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actionpack (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actionmailer (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actionmailbox (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actioncable (Red Hat package) Operating systems & Components / Operating system package or component python-pulpcore (Red Hat package) Operating systems & Components / Operating system package or component python-pulp-rpm (Red Hat package) Operating systems & Components / Operating system package or component python-pulp-container (Red Hat package) Operating systems & Components / Operating system package or component foreman (Red Hat package) Operating systems & Components / Operating system package or component candlepin (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Deserialization of Untrusted Data
EUVDB-ID: #VU65868
Risk: Medium
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-32224
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data in columns in active records. A remote privileged user write access to the database (e.g. via the restore pipeline) can create a specially crafted column and execute arbitrary code on the system during backup restoration.
Install updates from vendor's website.
Red Hat Satellite: 6.12
Red Hat Enterprise Linux for x86_64: 8.0
satellite-clone (Red Hat package): before 3.2.0-2.el8sat
satellite (Red Hat package): before 6.12.1-1.el8sat
rubygem-smart_proxy_container_gateway (Red Hat package): before 1.0.7-1.el8sat
rubygem-railties (Red Hat package): before 6.0.6-2.el8sat
rubygem-rails (Red Hat package): before 6.0.6-2.el8sat
rubygem-katello (Red Hat package): before 4.5.0.22-1.el8sat
rubygem-foreman_webhooks (Red Hat package): before 3.0.5-1.1.el8sat
rubygem-foreman_rh_cloud (Red Hat package): before 6.0.44-1.el8sat
rubygem-activesupport (Red Hat package): before 6.0.6-1.el8sat
rubygem-activestorage (Red Hat package): before 6.0.6-2.el8sat
rubygem-activerecord (Red Hat package): before 6.0.6-2.el8sat
rubygem-activemodel (Red Hat package): before 6.0.6-2.el8sat
rubygem-activejob (Red Hat package): before 6.0.6-2.el8sat
rubygem-actionview (Red Hat package): before 6.0.6-2.el8sat
rubygem-actiontext (Red Hat package): before 6.0.6-2.el8sat
rubygem-actionpack (Red Hat package): before 6.0.6-2.el8sat
rubygem-actionmailer (Red Hat package): before 6.0.6-2.el8sat
rubygem-actionmailbox (Red Hat package): before 6.0.6-2.el8sat
rubygem-actioncable (Red Hat package): before 6.0.6-2.el8sat
python-pulpcore (Red Hat package): before 3.18.11-1.el8pc
python-pulp-rpm (Red Hat package): before 3.18.9-1.el8pc
python-pulp-container (Red Hat package): before 2.10.10-1.el8pc
foreman (Red Hat package): before 3.3.0.18-1.el8sat
candlepin (Red Hat package): before 4.1.18-1.el8sat
CPE2.3- cpe:2.3:a:red_hat:red_hat_satellite:6.12:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:satellite-clone_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-smart_proxy_container_gateway_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-railties_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-rails_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-katello_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-foreman_webhooks_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-foreman_rh_cloud_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activesupport_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activestorage_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activerecord_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activemodel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activejob_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actionview_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actiontext_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actionpack_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actionmailer_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actionmailbox_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actioncable_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:python-pulpcore_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:python-pulp-rpm_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:python-pulp-container_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:foreman_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:candlepin_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:0261
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Code Injection
EUVDB-ID: #VU68307
Risk: High
CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]
CVE-ID: CVE-2022-42889
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an insecure variable interpolation when processing untrusted input. A remote attacker can send a specially crafted input and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability was dubbed Text4shell.
Install updates from vendor's website.
Red Hat Satellite: 6.12
Red Hat Enterprise Linux for x86_64: 8.0
satellite-clone (Red Hat package): before 3.2.0-2.el8sat
satellite (Red Hat package): before 6.12.1-1.el8sat
rubygem-smart_proxy_container_gateway (Red Hat package): before 1.0.7-1.el8sat
rubygem-railties (Red Hat package): before 6.0.6-2.el8sat
rubygem-rails (Red Hat package): before 6.0.6-2.el8sat
rubygem-katello (Red Hat package): before 4.5.0.22-1.el8sat
rubygem-foreman_webhooks (Red Hat package): before 3.0.5-1.1.el8sat
rubygem-foreman_rh_cloud (Red Hat package): before 6.0.44-1.el8sat
rubygem-activesupport (Red Hat package): before 6.0.6-1.el8sat
rubygem-activestorage (Red Hat package): before 6.0.6-2.el8sat
rubygem-activerecord (Red Hat package): before 6.0.6-2.el8sat
rubygem-activemodel (Red Hat package): before 6.0.6-2.el8sat
rubygem-activejob (Red Hat package): before 6.0.6-2.el8sat
rubygem-actionview (Red Hat package): before 6.0.6-2.el8sat
rubygem-actiontext (Red Hat package): before 6.0.6-2.el8sat
rubygem-actionpack (Red Hat package): before 6.0.6-2.el8sat
rubygem-actionmailer (Red Hat package): before 6.0.6-2.el8sat
rubygem-actionmailbox (Red Hat package): before 6.0.6-2.el8sat
rubygem-actioncable (Red Hat package): before 6.0.6-2.el8sat
python-pulpcore (Red Hat package): before 3.18.11-1.el8pc
python-pulp-rpm (Red Hat package): before 3.18.9-1.el8pc
python-pulp-container (Red Hat package): before 2.10.10-1.el8pc
foreman (Red Hat package): before 3.3.0.18-1.el8sat
candlepin (Red Hat package): before 4.1.18-1.el8sat
CPE2.3- cpe:2.3:a:red_hat:red_hat_satellite:6.12:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:satellite-clone_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:satellite_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-smart_proxy_container_gateway_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-railties_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-rails_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-katello_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-foreman_webhooks_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-foreman_rh_cloud_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activesupport_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activestorage_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activerecord_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activemodel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-activejob_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actionview_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actiontext_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actionpack_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actionmailer_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actionmailbox_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rubygem-actioncable_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:python-pulpcore_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:python-pulp-rpm_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:python-pulp-container_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:foreman_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:candlepin_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:0261
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.
