Satellite Capsule Red Hat Satellite Capsule

Do you want an email whenever new security vulnerabilities are reported in Red Hat Satellite Capsule?

By the Year

In 2022 there have been 0 vulnerabilities in Red Hat Satellite Capsule . Last year Satellite Capsule had 1 security vulnerability published. Right now, Satellite Capsule is on track to have less security vulnerabilities in 2022 than it did last year.

Year Vulnerabilities Average Score
2022 0 0.00
2021 1 6.50
2020 1 5.30
2019 0 0.00
2018 4 8.25

It may take a day or so for new Satellite Capsule vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Satellite Capsule Security Vulnerabilities

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view

CVE-2020-10716 6.5 - Medium - May 27, 2021

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.

AuthZ

A flaw was found in Hibernate Validator version 6.1.2.Final

CVE-2020-10693 5.3 - Medium - May 06, 2020

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

Improper Input Validation

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element

CVE-2018-1000632 7.5 - High - August 20, 2018

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

aka Blind XPath Injection

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers

CVE-2018-10237 5.9 - Medium - April 26, 2018

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Allocation of Resources Without Limits or Throttling

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore

CVE-2018-5382 9.8 - Critical - April 16, 2018

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.

Improper Validation of Integrity Check Value

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could

CVE-2017-15095 9.8 - Critical - February 06, 2018

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.\

Marshaling, Unmarshaling

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

CVE-2017-5929 9.8 - Critical - March 13, 2017

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

Marshaling, Unmarshaling

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Red Hat Satellite Capsule or by Red Hat? Click the Watch button to subscribe.

Red Hat
Vendor

subscribe