Multiple vulnerabilities in Red Hat Satellite 6.15

Published: 2024-12-09

Risk	Medium
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2024-26144 CVE-2024-26146 CVE-2024-26141 CVE-2024-25126 CVE-2024-23342
CWE-ID	CWE-200 CWE-20 CWE-185 CWE-310
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Red Hat Satellite Server applications / Other server solutions Red Hat Enterprise Linux for x86_64 Operating systems & Components / Operating system satellite (Red Hat package) Operating systems & Components / Operating system package or component rubygem-smart_proxy_ansible (Red Hat package) Operating systems & Components / Operating system package or component rubygem-railties (Red Hat package) Operating systems & Components / Operating system package or component rubygem-rails (Red Hat package) Operating systems & Components / Operating system package or component rubygem-katello (Red Hat package) Operating systems & Components / Operating system package or component rubygem-foreman_rh_cloud (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activesupport (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activestorage (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activerecord (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activemodel (Red Hat package) Operating systems & Components / Operating system package or component rubygem-activejob (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actionview (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actiontext (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actionpack (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actionmailer (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actionmailbox (Red Hat package) Operating systems & Components / Operating system package or component rubygem-actioncable (Red Hat package) Operating systems & Components / Operating system package or component python-pulp-container (Red Hat package) Operating systems & Components / Operating system package or component puppetserver (Red Hat package) Operating systems & Components / Operating system package or component pulpcore-obsolete-packages (Red Hat package) Operating systems & Components / Operating system package or component foreman-installer (Red Hat package) Operating systems & Components / Operating system package or component foreman (Red Hat package) Operating systems & Components / Operating system package or component rubygem-rack (Red Hat package) Operating systems & Components / Operating system package or component foreman-fapolicyd (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU86810

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-26144

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Active Storage send a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Such cookie can be cached certain proxies and lead to information disclosure.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.15.0 - 6.15.4.2

Red Hat Enterprise Linux for x86_64: 8.0

satellite (Red Hat package): before 6.15.5-1.el8sat

rubygem-smart_proxy_ansible (Red Hat package): before 3.5.6-0.1.el8sat

rubygem-railties (Red Hat package): before 6.1.7.7-2.el8sat

rubygem-rails (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-katello (Red Hat package): before 4.11.0.19-1.el8sat

rubygem-foreman_rh_cloud (Red Hat package): before 9.0.59-1.el8sat

rubygem-activesupport (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-activestorage (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-activerecord (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-activemodel (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-activejob (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-actionview (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-actiontext (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-actionpack (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-actionmailer (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-actionmailbox (Red Hat package): before 6.1.7.7-1.el8sat

rubygem-actioncable (Red Hat package): before 6.1.7.7-1.el8sat

python-pulp-container (Red Hat package): before 2.16.9-2.el8pc

puppetserver (Red Hat package): before 7.17.2-1.el8sat

pulpcore-obsolete-packages (Red Hat package): before 1.0-10.el8pc

foreman-installer (Red Hat package): before 3.9.3.7-1.el8sat

foreman (Red Hat package): before 3.9.1.12-1.el8sat

rubygem-rack (Red Hat package): before 2.2.8.1-1.el8sat

foreman-fapolicyd (Red Hat package): before 1.0.1-3.el8sat

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2024:10806

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU87008

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-26146

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the header parsing. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.