{"id":"CVE-2023-4886","aliases":["EUVD-2023-54725","GHSA-r2mj-49jv-4jq7","RHSA-2023:7851","RHSA-2024:1061"],"status":"published","title":"Foreman: world readable file containing secrets","description":"A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00288,"percentile":0.21546,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2023-10-03T14:24:56Z","modified":"2026-10-28T02:30:53Z","affected":[{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.0.5-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman-installer-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.0.5-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.0.5-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-installer-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.0.5-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.10-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"createrepo_c-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"pulpcore-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-django-import-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.11-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.19-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.18-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python3-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python3-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-django-import-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.11-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.19-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.18-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"rubygem-smart_proxy_remote_execution_ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.2-2.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"createrepo_c-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"pulpcore-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-django-import-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.11-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.19-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.18-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python3-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python3-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-django-import-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.11-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.22.19-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.18-0.1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actioncable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionmailbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actiontext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activejob","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activemodel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-foreman_leapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.2-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.2-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0.18-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.4-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-smart_proxy_remote_execution_ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.2-2.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"satellite-convert2rhel-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.17-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"mosquitto-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.17-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"mosquitto-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.17-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.17-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"mosquitto-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.17-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"mosquitto-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.17-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.13::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.13::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.13::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1.24-1.el8sat"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat satellite 6.13 for rhel 8"},{"vendor":"red hat","product":"red hat satellite 6.14 for rhel 8"},{"vendor":"redhat","product":"satellite"},{"vendor":"theforeman","product":"foreman"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7851","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1061","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4886","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230135","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4886","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r2mj-49jv-4jq7"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4886.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_red_hat_satellite_to_6.14/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250343","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254085","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7851.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4886","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28362","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41040","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-43804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242493","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43804","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45803","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9","tags":["article"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110.html#name-get","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html/upgrading_and_updating_red_hat_satellite/index","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2145254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257300","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264918","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265149","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1061.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4130","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0809","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0809","tags":["advisory"]},{"url":"https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3592","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3592","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3592","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28366","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4886","title":"Foreman: world readable file containing secrets","description":"A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.","status":"published","published":"2023-10-03T14:24:56.342Z","modified":"2026-02-25T18:32:04.057Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:30.851125Z"}],"euvd":[{"id":"EUVD-2023-54725","description":"A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.","status":"published","published":"2023-10-03T14:24:56Z","modified":"2026-02-25T18:32:04Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:28.530473Z"}],"ghsa":[{"id":"GHSA-r2mj-49jv-4jq7","title":"A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server...","description":"A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.","status":"published","published":"2023-10-03T15:30:34Z","modified":"2024-03-01T03:30:34Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:55:38.39087Z"}],"nvd":[{"id":"CVE-2023-4886","description":"A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.","status":"published","published":"2023-10-03T15:15:40.737Z","modified":"2026-06-17T06:38:49.607Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:08:35.022405Z"}],"osv":[{"id":"CVE-2023-4886","title":"Foreman: world readable file containing secrets","description":"A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.","status":"published","published":"2023-10-03T14:24:56.342Z","modified":"2026-10-28T02:30:53.639457272Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"RHSA-2023:7851","title":"Red Hat Security Advisory: Satellite 6.14.1 Async Security Update","status":"published","published":"2024-09-18T05:14:53Z","modified":"2026-09-09T10:02:38Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:1061","title":"Red Hat Security Advisory: Red Hat Satellite 6 security and bug fix update","status":"published","published":"2024-09-16T17:34:41Z","modified":"2026-06-26T12:22:22.133003512Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"}]}}