{"id":"CVE-2026-4324","aliases":["EUVD-2026-12572","GHSA-fwj4-6wgp-mpxm","RHSA-2026:22326","RHSA-2026:5968","RHSA-2026:5970"],"status":"published","title":"Rubygem-katello: katello: denial of service and potential information disclosure via sql injection","description":"A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00278,"percentile":0.20426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-03-17T13:52:14Z","modified":"2026-11-03T17:19:55Z","fixes":[{"ecosystem":"RubyGems","package":"katello","fixed_in":["4.19.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.1"}]}],"versions":["1.5.0","2.2.2","2.4.0","2.4.0.rc1","2.4.0.rc2","2.4.0.rc3","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","3.0.0","3.0.0.rc1","3.0.0.rc2","3.0.0.rc3","3.0.0.rc4","3.0.0.rc5","3.0.0.rc7","3.0.1","3.0.2","3.1.0","3.1.0.1","3.1.0.rc1","3.1.0.rc2.1","3.10.0","3.10.0.rc1","3.10.0.rc1.1","3.10.1","3.10.1.1","3.10.2","3.11.0","3.11.0.rc1","3.11.0.rc2","3.11.1","3.11.2","3.12.0","3.12.0.rc1","3.12.0.rc2","3.12.1","3.12.2","3.12.3","3.13.0","3.13.0.rc1","3.13.0.rc2","3.13.0.rc2.1","3.13.1","3.13.2","3.13.3","3.13.4","3.14.0","3.14.0.rc1","3.14.0.rc2","3.14.1","3.15.0","3.15.0.1","3.15.0.rc1","3.15.0.rc1.1","3.15.0.rc1.2","3.15.0.rc1.3","3.15.0.rc2","3.15.1","3.15.1.1","3.15.2","3.15.3","3.15.3.1","3.16.0","3.16.0.rc1","3.16.0.rc1.1","3.16.0.rc2","3.16.0.rc2.1","3.16.0.rc3","3.16.0.rc3.1","3.16.0.rc4","3.16.0.rc4.1","3.16.0.rc5","3.16.0.rc5.1","3.16.1","3.16.1.1","3.16.1.2","3.16.2","3.17.0","3.17.0.rc1","3.17.0.rc2","3.17.0.rc2.1","3.17.0.rc2.2","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0.rc1","3.18.0.rc2","3.18.0.rc2.1","3.18.1","3.18.1.1","3.18.2","3.18.2.1","3.18.3","3.18.3.1","3.18.4","3.18.5","3.2.0","3.2.0.rc1","3.2.0.rc1.1","3.2.0.rc2","3.2.0.rc3","3.2.1","3.2.1.1","3.3.0","3.3.0.1","3.3.0.rc1","3.3.0.rc1.1","3.3.0.rc2","3.3.1","3.3.1.1","3.3.2","3.4.0","3.4.0.1","3.4.0.2","3.4.0.rc1","3.4.0.rc2","3.4.1","3.4.2","3.4.4","3.4.5","3.5.0","3.5.0.1","3.5.0.rc1","3.5.0.rc2","3.5.1","3.5.1.1","3.5.2","3.6.0","3.6.0.1.rc2","3.6.0.rc1","3.6.0.rc2","3.7.0","3.7.0.rc1","3.7.0.rc2","3.7.1","3.7.1.1","3.8.0","3.8.0.rc1","3.8.0.rc2","3.8.0.rc3","3.8.1","3.9.0","3.9.0.rc1","3.9.0.rc2","3.9.1","4.0.0","4.0.0.rc1","4.0.0.rc2","4.0.0.rc3","4.0.0.rc3.1","4.0.1","4.0.1.1","4.0.1.2","4.0.2","4.0.2.1","4.0.3","4.1.0","4.1.0.rc1","4.1.0.rc1.1","4.1.0.rc2","4.1.0.rc2.1","4.1.0.rc2.2","4.1.1","4.1.2","4.1.2.1","4.1.3","4.1.4","4.10.0","4.10.0.rc1","4.10.0.rc2","4.11.0","4.11.0.rc1","4.11.0.rc2","4.11.1","4.12.0","4.12.0.rc1","4.12.0.rc2","4.12.0.rc3","4.12.1","4.13.0","4.13.0.rc1","4.13.1","4.14.0","4.14.0.rc1","4.14.0.rc1.1","4.14.0.rc2","4.14.0.rc3","4.14.1","4.14.2","4.14.3","4.15.0","4.15.0.rc1","4.15.0.rc2","4.15.1","4.16.0","4.16.0.rc1","4.16.0.rc2","4.16.1","4.16.2","4.16.3","4.17.0","4.17.0.rc1","4.17.0.rc2","4.17.1","4.17.2","4.18.0","4.18.0.rc1","4.18.0.rc2","4.18.1","4.19.0.1","4.19.0.rc1","4.19.0.rc2","4.2.0.1","4.2.0.1.rc2","4.2.0.1.rc3","4.2.0.rc1","4.2.0.rc2","4.2.1","4.2.2","4.3.0","4.3.0.rc1","4.3.0.rc2","4.3.0.rc2.1","4.3.0.rc3","4.3.0.rc4","4.3.1","4.4.0","4.4.0.1","4.4.0.2","4.4.0.rc1","4.4.0.rc2","4.4.1","4.4.2","4.4.2.1","4.4.2.2","4.5.0","4.5.0.rc1","4.5.0.rc2","4.5.1","4.6.0","4.6.0.rc1","4.6.0.rc2","4.6.1","4.6.2","4.6.2.1","4.7.0","4.7.0.rc1","4.7.0.rc2","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.8.0","4.8.0.rc1","4.8.0.rc2","4.8.1","4.8.2","4.8.3","4.8.4","4.9.0","4.9.0.rc1","4.9.0.rc2","4.9.1","4.9.2"]},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.20.0.4-1.el9sat"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.el9sat"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.el9sat"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-4.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-rubyipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.0-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-rubyipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.0-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-foreman_kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.3-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.12-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0.9-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"libcomps-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-brotli-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.28-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.22.3-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.27.10-2.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3-libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3-libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-brotli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.28-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.22.3-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.27.10-2.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-rubyipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.0-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.17::el9","package":"libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.17::el9","package":"libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.17::el9","package":"libcomps-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.17::el9","package":"python3-libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.17::el9","package":"python3-libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.17::el9","package":"python3.11-libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"libcomps-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-brotli-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.28-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.22.3-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.27.10-2.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3-libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3-libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-brotli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.28-0.1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.23-0.3.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.22.3-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pulp-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.27.10-2.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-fog-kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.3-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0.14-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-rubyipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.0-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.7-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-4.el9sat"}]}],"bundled":12}],"products":[{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat satellite 6.17 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.18 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.19 for rhel 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:22326","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5968","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5970","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4324","tags":["vdb-entry","x_refsource_REDHAT","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448349","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4324","tags":["advisory"]},{"url":"https://github.com/Katello/katello/commit/a0a793b08d4f0a897ee985d79a687ad043f99e57","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fwj4-6wgp-mpxm"},{"url":"https://github.com/Katello/katello","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-40215","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-44554","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45125","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45126","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45127","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45128","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45130","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45131","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22326.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4324","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32282","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://go.dev/cl/763761","tags":["article"]},{"url":"https://go.dev/issue/78293","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4864","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-41530","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42707","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42708","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42710","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42711","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42712","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42713","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42714","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42715","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42716","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42717","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42718","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-43310","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-43742","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-43743","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5968.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","tags":["advisory"]},{"url":"https://go.dev/cl/736712","tags":["article"]},{"url":"https://go.dev/issue/77101","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4341","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","tags":["advisory"]},{"url":"https://go.dev/cl/725920","tags":["article"]},{"url":"https://go.dev/issue/76445","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4155","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","tags":["advisory"]},{"url":"https://go.dev/cl/737700","tags":["article"]},{"url":"https://go.dev/issue/77217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4337","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0980","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1531","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1961","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437036","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1961","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2408762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436342","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-42871","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42873","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42881","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-42882","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-43118","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5970.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-6176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6176","tags":["advisory"]},{"url":"https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14550","tags":["advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["article"]},{"url":"https://groups.google.com/g/django-announce","tags":["article"]},{"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1207","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1207","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1207","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1285","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1312","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1312","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1530","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1530","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-4324","title":"Rubygem-katello: katello: denial of service and potential information disclosure via sql injection","description":"A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.","status":"published","published":"2026-03-17T13:52:14.756Z","modified":"2026-11-03T17:19:55.922Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-03T19:01:23.264561Z"}],"euvd":[{"id":"EUVD-2026-12572","description":"A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.","status":"published","published":"2026-03-17T13:52:14Z","modified":"2026-11-03T17:19:55Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T18:19:04.249016Z"}],"ghsa":[{"id":"GHSA-fwj4-6wgp-mpxm","title":"Katello: Denial of Service and potential information disclosure via SQL injection","description":"A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.","status":"published","published":"2026-03-17T15:36:23Z","modified":"2026-06-01T21:30:32Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:40:15.638885Z"}],"nvd":[{"id":"CVE-2026-4324","description":"A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.","status":"published","published":"2026-03-17T14:16:19.777Z","modified":"2026-06-17T10:56:25.173Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"GHSA-fwj4-6wgp-mpxm","title":"Katello: Denial of Service and potential information disclosure via SQL injection","description":"A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.","status":"published","published":"2026-03-17T15:36:23Z","modified":"2026-06-01T21:45:26.641319992Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"RHSA-2026:22326","title":"Red Hat Security Advisory: Satellite 6.19.1 Async Update","status":"published","published":"2026-06-02T10:08:40Z","modified":"2026-10-20T10:06:12Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:5968","title":"Red Hat Security Advisory: Satellite 6.18.4 Async Update","status":"published","published":"2026-03-27T10:14:45Z","modified":"2026-10-20T10:12:10Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:5970","title":"Red Hat Security Advisory: Satellite 6.17.7 Async Update","status":"published","published":"2026-03-27T10:14:45Z","modified":"2026-10-17T10:16:32Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"}]}}