{"id":"CVE-2025-10622","aliases":["EUVD-2025-37786","GHSA-f5h4-c4jw-c4gm","RHSA-2025:19721","RHSA-2025:19832","RHSA-2025:19855","RHSA-2025:19856"],"status":"published","title":"Foreman: os command injection via ct_location and fcct_location parameters","description":"A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00728,"percentile":0.54644,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-602","CWE-78"],"published":"2025-11-05T07:32:14Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-debug","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-pcp","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman-cli","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-cli","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-debug","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-dynflow-sidekiq","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-ec2","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-journald","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-libvirt","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-openstack","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-pcp","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-postgresql","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-redis","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-service","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-telemetry","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-vmware","fixed_in":["0:3.16.0.4-1.el9sat"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.4-1.el9sat"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.10-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.20-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.20-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.11-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.20-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.20-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.20-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.20-1.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.15::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.13-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.20-1.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.20-1.el8sat"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat satellite 6.15 for rhel 8"},{"vendor":"red hat","product":"red hat satellite 6.16 for rhel 8"},{"vendor":"red hat","product":"red hat satellite 6.16 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.17 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.18 for rhel 9"},{"vendor":"the foreman","product":"foreman"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:19721","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:19832","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:19855","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:19856","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10622","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396020","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://theforeman.org/security.html#2025-10622","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10622","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f5h4-c4jw-c4gm"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10622.json","tags":["advisory"]},{"url":"https://github.com/theforeman/foreman","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-11875","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-12005","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-15137","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-15682","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-18422","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-18815","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-20253","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-20700","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-21126","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-21129","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-21543","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-21841","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-22589","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-22655","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-22998","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-23121","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-23671","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-24007","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-24175","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-25184","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-25333","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-25438","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-25439","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-25805","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-25905","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-25968","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-26013","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-26487","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-26559","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-26877","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-26905","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-27377","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-27474","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-27628","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-27937","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28085","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28214","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28460","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28485","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28495","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28694","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29428","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29574","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29657","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29736","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29785","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29942","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30006","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30039","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30122","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30123","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30137","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30221","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30370","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30471","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30510","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30594","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30670","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30838","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30896","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30897","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30899","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30900","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30901","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30902","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30903","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30904","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30909","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30915","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30917","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30976","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30999","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31026","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31028","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31029","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31030","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31104","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31137","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31185","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31194","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31195","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31224","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31226","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31251","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31357","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31360","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31367","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31388","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31392","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31397","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31400","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31411","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31421","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31424","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31449","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31467","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31561","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31578","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31580","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31654","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31655","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31763","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31806","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31807","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31827","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31842","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31859","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31947","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31966","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31979","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-31997","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32223","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32437","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32464","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32465","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32471","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32491","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32561","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32574","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32611","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32615","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32622","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32667","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32697","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32710","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-32715","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33154","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33189","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33242","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33243","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33248","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33254","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33255","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33256","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33257","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33258","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33259","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33260","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33261","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33306","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33371","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33399","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33407","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33408","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33412","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33413","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33414","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33455","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33475","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33496","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33501","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-33817","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34021","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34023","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34055","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34089","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34090","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34092","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34133","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34146","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34147","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34224","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34231","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34243","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34258","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34271","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34301","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34510","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34546","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34564","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34592","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34621","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34649","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34713","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34777","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34778","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34857","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34926","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34977","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-34995","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35160","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35208","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35219","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35228","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35235","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35244","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35248","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35249","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35282","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35290","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35293","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35303","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35304","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35327","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35343","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35395","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35461","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35489","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35513","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35628","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35651","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35722","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35868","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35876","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35909","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35922","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35946","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35983","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35989","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35992","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35994","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-35996","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36007","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36015","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36022","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36023","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36030","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36031","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36032","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36033","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36046","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36047","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36048","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36050","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36051","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36061","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36063","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36064","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36154","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36158","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36218","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36219","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36234","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36259","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36284","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36322","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36363","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36379","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36442","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36515","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36518","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36532","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36545","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36586","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36721","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36743","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36779","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36783","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-36784","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37075","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37076","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37144","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37154","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37160","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37282","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37300","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37341","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37345","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37358","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37361","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37365","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37390","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37393","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37394","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37395","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37634","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37636","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37641","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37669","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37671","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37676","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37809","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37810","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37817","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-37928","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38105","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38185","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38347","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38691","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38707","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38769","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39135","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39180","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19721.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10622","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2398167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2403180","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-39213","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39215","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39216","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39217","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39218","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39219","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39232","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19832.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59830","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59830","tags":["advisory"]},{"url":"https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71","tags":["article"]},{"url":"https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61919","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61919","tags":["advisory"]},{"url":"https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881","tags":["article"]},{"url":"https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db","tags":["article"]},{"url":"https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f","tags":["article"]},{"url":"https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-39698","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19855.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19856.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-10622","title":"Foreman: os command injection via ct_location and fcct_location parameters","description":"A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.","status":"published","published":"2025-11-05T07:32:14.39Z","modified":"2026-02-26T17:47:17.722Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-37786","description":"A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.","status":"published","published":"2025-11-05T07:32:14Z","modified":"2026-02-26T17:47:17Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:23.405029Z"}],"ghsa":[{"id":"GHSA-f5h4-c4jw-c4gm","title":"A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an...","description":"A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.","status":"published","published":"2025-11-05T09:30:25Z","modified":"2026-02-06T21:31:48Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78","CWE-602"],"updated_at":"2026-11-02T15:06:05.349002Z"}],"nvd":[{"id":"CVE-2025-10622","description":"A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.","status":"published","published":"2025-11-05T08:15:32.99Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:42.142547Z"}],"osv":[{"id":"CVE-2025-10622","title":"Foreman: os command injection via ct_location and fcct_location parameters","description":"A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.","status":"published","published":"2025-11-05T07:32:14.39Z","modified":"2026-10-28T02:30:47.653675549Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"RHSA-2025:19721","title":"Red Hat Security Advisory: Satellite 6.18.0 new version release","status":"published","published":"2025-11-05T10:05:04Z","modified":"2026-07-12T10:04:41Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:19832","title":"Red Hat Security Advisory: Satellite 6.17.6 Async Update","status":"published","published":"2025-11-06T10:06:09Z","modified":"2026-09-01T10:07:16Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:19855","title":"Red Hat Security Advisory: Satellite 6.16.5.5 Async Update","status":"published","published":"2025-11-06T10:06:16Z","modified":"2026-09-01T10:07:23Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:19856","title":"Red Hat Security Advisory: Satellite 6.15.5.6 Async Update","status":"published","published":"2025-11-06T10:06:17Z","modified":"2026-09-01T10:07:24Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"}]}}