rubygem-katello vulnerabilities (Red Hat)
117 vulnerabilities.
-
rubygem-katelloRed Hat Rubygem-katello: improper authorization logic allows resource enumeration 4.3 Medium -
rubygem-katelloRed Hat Rubygem-katello: sql injection in registry proxy via labels 6.5 Medium -
rubygem-katelloRed Hat Rubygem-hammer_cli: command injection via insecure editor invocation 6.7 Medium -
rubygem-katelloRed Hat Foreman: command injection in foreman-tail 5.3 Medium -
rubygem-katelloRed Hat Foreman: excessive permissions for viewer role on preview 9.1 Critical -
rubygem-katelloRed Hat Foreman: foreman: arbitrary code execution via safemode sandbox bypass 8.8 High -
rubygem-katelloRed Hat Foreman: ssti and insecure deserialization in foreman-rake configuration 7.7 High -
rubygem-katelloRed Hat Foreman: command injection in foreman-rake database tasks 8.2 High -
rubygem-katelloRed Hat Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter 8.2 High -
rubygem-katelloRed Hat Foreman: unauthenticated information disclosure via provisioning token validation flaw 7.5 High -
rubygem-katelloRed Hat Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter 8.8 High -
rubygem-katelloRed Hat GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation 8.7 High -
rubygem-katelloRed Hat fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority 7.5 High -
rubygem-katelloRed Hat fast-uri vulnerable to authority injection via an unvalidated port in serialize 7.5 High -
rubygem-katelloRed Hat Ketello: katello content view history api cross-organization authorization bypass 4.3 Medium -
rubygem-katelloRed Hat GitPython before 3.1.59 Arbitrary File Read via TagReference.create 7.1 High -
rubygem-katelloRed Hat sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger 8.7 High -
rubygem-katelloRed Hat sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) 7.5 High -
rubygem-katelloRed Hat sqlparse: Quadratic O(n²) DoS in group_comments 8.7 High -
rubygem-katelloRed Hat Limit handshake messages we are willing to accept post-handshake in crypto/tls 7.5 High -
rubygem-katelloRed Hat Avoid quadratic complexity in resolvePath in net/url 5.9 Medium -
rubygem-katelloRed Hat Fix Javascript regexp context tracking in html/template 6.1 Medium -
rubygem-katelloRed Hat Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http 7.5 High -
rubygem-katelloRed Hat Enforce maximum recursion depth in encoding/asn1 7.5 High -
rubygem-katelloRed Hat fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization 7.5 High -
rubygem-katelloRed Hat fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references 7.5 High -
rubygem-katelloRed Hat fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding 7.5 High -
rubygem-katelloRed Hat GitPython before 3.1.57 Arbitrary File Overwrite and Read 7.2 High -
rubygem-katelloRed Hat nanoid: Integer Overflow or Wraparound 7.4 High -
rubygem-katelloRed Hat GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() 8.7 High -
rubygem-katelloRed Hat GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling 8.7 High -
rubygem-katelloRed Hat GitPython before 3.1.54 Remote Code Execution via --template 7.7 High -
rubygem-katelloRed Hat GitPython before 3.1.54 Arbitrary File Overwrite via diff 7.2 High -
rubygem-katelloRed Hat PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments 7.5 High -
rubygem-katelloRed Hat Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` 8.2 High -
rubygem-katelloRed Hat Immutable.js `List` 32-bit trie overflow → unrecoverable DoS 8.7 High -
rubygem-katelloRed Hat Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading 7.5 High -
rubygem-katelloRed Hat Pillow GdImageFile decompression bomb protection bypass 7.5 High -
rubygem-katelloRed Hat Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` 7.5 High -
rubygem-katelloRed Hat Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading 7.5 High -
rubygem-katelloRed Hat lxml: javascript: URL bypass in Cleaner via xlink:href 8.2 High -
rubygem-katelloRed Hat Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters 7.5 High -
rubygem-katelloRed Hat Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception 1.7 Low -
rubygem-katelloRed Hat Katello: missing repository authorization in content_uploads exposes cross-product content existence 4.3 Medium -
rubygem-katelloRed Hat Quadratic complexity in WordDecoder.DecodeHeader in mime 7.5 High -
rubygem-katelloRed Hat PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed 7.4 High -
rubygem-katelloRed Hat Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data 7.8 High -
rubygem-katelloRed Hat GitPython: Command injection via Git options bypass 8.8 High -
rubygem-katelloRed Hat GitPython: Unsafe option check validates multi_options before shlex.split transforms it 8.1 High -
rubygem-katelloRed Hat HTTP Request Smuggling via Chunked Extension Quoted-String Parsing 7.4 High - Show olderLoading…