Yüksek CVSS 7.7
CVE-2026-12544: Satellite: güvenilmeyen verinin serileştirmeden çıkarılması
Açıklama (NVD)
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
Özet bilgiler
- Ürün
- Redhat Satellite
- CVSS v3.1
- 7.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - EPSS
- %0,23 (yüzdelik 13)
- CWE
- CWE-502
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| redhat-satellite | 6.0 | 6.0 | — |
| redhat-satellite | 6.16 | — | 6.16.4 |
| redhat-satellite | 6.17 | — | 6.17.12 |
| redhat-satellite | 6.19 | — | 6.19.5 |
| theforeman-foreman | — | — | — |
| redhat-satellite | 6.18 | — | 6.18.10 |