AI analysis
An SQL injection flaw in rubygem-katello allows a low-privileged user to read data through the Red Hat Satellite Katello Registry Proxy. In RegistryProxiesController, check_blob_push_org_label and get_matching_products_from_org take organization labels from the request path and insert them into raw SQL without sanitization. A user who has only the create_personal_access_tokens permission can trigger this over the network even with no Organization or Location assigned, with high impact to confidentiality and no direct integrity or availability impact (CVSS 3.1 6.5). Katello installs that are not yet on the fixed releases are affected. No public proof of concept is known and the issue is not in the CISA KEV catalog.
What to do: Upgrade rubygem-katello to 4.21.2 or 5.0.1 (or later) using the Red Hat Satellite errata for your release. Until that is done, limit the create_personal_access_tokens permission to trusted administrators and review accounts that hold it with no Organization or Location assigned, since that right is enough to reach the flaw.
Affected
| Red Hat rubygem-katello (Katello Registry Proxy, used by Red Hat Satellite) | Fixed in 4.21.2 and 5.0.1; earlier releases in those lines are affected |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.