Information Exposure

Overview katello is a package that adds Content and Subscription Management to Foreman Affected versions of this package are vulnerable to Information Exposure via an errata-related API. An authenticated user can expose internal IDs. This is caused by an incomplete fix for CVE-2016-3072...

PT-2018-12622 · Red Hat · Katello

Name of the Vulnerable Software and Affected Versions: katello versions 3.10 and older Description: A SQL injection flaw was found in katello's errata-related API, allowing an authenticated remote attacker to craft input data and force a malformed SQL query to the backend database. This can resul...

katello: SQL inject in errata-related REST API

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs...