A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unfUpgrade python-qpid-protonUpgrade python3-psutil-debuginfoUpgrade tfm-rubygem-unicode-display_widthUpgrade katello-host-tools-fact-pluginUpgrade qpid-proton-c-debuginfoUpgrade python-psutil-debuginfoUpgrade satellite-cliUpgrade tfm-rubygem-awesome_printUpgrade tfm-rubygem-hammer_cli_csvUpgrade katello-host-toolsUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-little-pluggerUpgrade katello-agentUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade python-psutilUpgrade tfm-ror52-runtimeUpgrade python-psutil-debugsourceUpgrade tfm-runtimeUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-unf_extUpgrade rubygem-json-debuginfoUpgrade tfm-rubygem-loggingUpgrade python3-qpid-protonUpgrade tfm-rubygem-unicode-debuginfoUpgrade python-isodateUpgrade python2-futureUpgrade python-gofer-protonUpgrade tfm-rubygem-apipie-bindingsUpgrade satelliteUpgrade qpid-proton-cpp-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade katello-host-tools-tracerUpgrade python2-tracerUpgrade qpid-proton-debuginfoUpgrade rubygem-foreman_scap_clientUpgrade tfm-rubygem-http-cookieUpgrade python3-psutilUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade python-uuidUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-highlineUpgrade satellite-brandingUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_dockerUpgrade goferUpgrade python3-qpid-proton-debuginfoUpgrade python-pulp-rpm-commonUpgrade python-goferUpgrade python-hashlibUpgrade tfm-ror52-rubygem-mime-typesUpgrade python3-beautifulsoup4Upgrade python2-beautifulsoup4Upgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade pulp-puppet-toolsUpgrade python-pulp-commonUpgrade tfm-rubygem-netrcUpgrade python-pulp-puppet-commonUpgrade python3-gofer-protonUpgrade python-argcompleteUpgrade qpid-proton-cUpgrade foreman-cliUpgrade tracer-commonUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-rest-clientUpgrade rubygem-jsonUpgrade python-pulp-manifestUpgrade tfm-rubygem-hammer_cliUpgrade qpid-proton-debugsourceUpgrade python-hashlib-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade python3-tracerUpgrade tfm-ror52-rubygem-multi_jsonUpgrade tfm-ror52-rubygem-mime-types-dataUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-clampUpgrade python3-goferUpgrade python3-futureUpgrade pulp-rpm-handlersUpgrade puppet-agentUpgrade python-pulp-agent-lib | Aug 28, 2019 | Apr 11, 2019 |
| Redhat_linux | — | Upgrade pulp-rpm-handlersUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_csvUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unicode-debuginfoUpgrade python-pulp-agent-libUpgrade python-isodateUpgrade tfm-ror52-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foremanUpgrade python-psutil-debuginfoUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-awesome_printUpgrade satellite-brandingUpgrade foreman-cliUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-little-pluggerUpgrade qpid-proton-debugsourceUpgrade python-hashlibUpgrade katello-host-tools-fact-pluginUpgrade qpid-proton-debuginfoUpgrade python-pulp-manifestUpgrade python-hashlib-debuginfoUpgrade python3-goferUpgrade python-psutil-debugsourceUpgrade tfm-ror52-runtimeUpgrade python2-futureUpgrade python-uuidUpgrade rubygem-json-debuginfoUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-fast_gettextUpgrade python2-beautifulsoup4Upgrade python-qpid-protonUpgrade python-psutilUpgrade python-gofer-protonUpgrade tfm-rubygem-apipie-bindingsUpgrade python3-gofer-protonUpgrade python3-qpid-protonUpgrade python-pulp-commonUpgrade tfm-rubygem-domain_nameUpgrade python-pulp-puppet-commonUpgrade katello-host-tools-tracerUpgrade python3-beautifulsoup4Upgrade katello-agentUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade qpid-proton-cpp-debuginfoUpgrade python3-futureUpgrade tracer-commonUpgrade tfm-rubygem-hammer_cliUpgrade python-pulp-rpm-commonUpgrade tfm-runtimeUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade python2-tracerUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade python3-psutil-debuginfoUpgrade tfm-ror52-rubygem-mime-types-dataUpgrade python3-psutilUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-rest-clientUpgrade satellite-cliUpgrade tfm-rubygem-unf_extUpgrade python3-tracerUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_dockerUpgrade goferUpgrade tfm-rubygem-oauthUpgrade pulp-puppet-toolsUpgrade qpid-proton-c-debuginfoUpgrade tfm-rubygem-powerbarUpgrade rubygem-foreman_scap_clientUpgrade puppet-agentUpgrade rubygem-jsonUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-localeUpgrade tfm-ror52-rubygem-multi_jsonUpgrade satelliteUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade python3-qpid-proton-debuginfoUpgrade qpid-proton-cUpgrade tfm-rubygem-http-cookieUpgrade python-goferUpgrade katello-host-toolsUpgrade tfm-rubygem-highlineUpgrade python-argcomplete | May 15, 2019 | Apr 11, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub