{"id":"CVE-2023-0462","aliases":["EUVD-2023-12516","GHSA-6c26-fwvj-8945","RHSA-2023:5931","RHSA-2023:5979","RHSA-2023:5980"],"status":"published","title":"Arbitrary code execution through yaml global parameters","description":"An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00961,"percentile":0.61834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2023-09-20T13:40:43Z","modified":"2026-10-28T02:30:35Z","affected":[{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.13::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.23-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.0-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-1.el8sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.23-1.el8sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.23-1.el8sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.23-1.el8sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.0-1.el8sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-1.el8sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-1.el8sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.0-0.1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.0-0.1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el7","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.27-1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-1.el7sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-1.el8sat"}]}],"bundled":8}],"products":[{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"redhat","product":"satellite"},{"vendor":"theforeman","product":"foreman"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-0462","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162970","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0462","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6c26-fwvj-8945"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0462.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5931","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html/upgrading_and_updating_red_hat_satellite/index","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2151583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243296","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5931.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20220503.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20220621.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3874","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24439","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24439","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24439","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46648","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN16765254/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-47318","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-47318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47318","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0462","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3817","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230731.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-31047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31047","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/may/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-36053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36053","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/jul/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://go.dev/issue/63417","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40267","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40267","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40267","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pr76-5cm5-w9cj","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5979","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.12/html/upgrading_and_updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159291","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5979.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0118","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0118","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5980","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/upgrading_and_updating_red_hat_satellite/index#updating_satellite","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5980.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-0462","title":"Arbitrary code execution through yaml global parameters","description":"An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.","status":"published","published":"2023-09-20T13:40:43.213Z","modified":"2024-09-24T15:05:20.612Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:35.256261Z"}],"euvd":[{"id":"EUVD-2023-12516","description":"An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.","status":"published","published":"2023-09-20T13:40:43Z","modified":"2024-09-24T15:05:20Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:15.73715Z"}],"ghsa":[{"id":"GHSA-6c26-fwvj-8945","title":"An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to...","description":"An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.","status":"published","published":"2023-09-20T15:30:51Z","modified":"2024-04-04T07:45:49Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:56:54.849147Z"}],"nvd":[{"id":"CVE-2023-0462","description":"An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.","status":"published","published":"2023-09-20T14:15:12.99Z","modified":"2026-06-17T05:25:36.35Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-0462","title":"Arbitrary code execution through yaml global parameters","description":"An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.","status":"published","published":"2023-09-20T13:40:43.213Z","modified":"2026-10-28T02:30:35.569220862Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"RHSA-2023:5931","title":"Red Hat Security Advisory: Satellite 6.13.5 Async Security Update","status":"published","published":"2024-10-02T11:22:53Z","modified":"2026-10-20T10:01:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5979","title":"Red Hat Security Advisory: Satellite 6.12.5.2 Async Security Update","status":"published","published":"2024-10-02T11:23:56Z","modified":"2026-10-20T10:02:01Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5980","title":"Red Hat Security Advisory: Satellite 6.11.5.6 async security update","status":"published","published":"2024-10-02T11:24:07Z","modified":"2026-10-20T10:02:02Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"}]}}