Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

katello

8 known vulnerabilities (6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 6 medium
Registry
RubyGems

Advisories 8

  • CVE-2026-12515Medium 4.3

    Katello: missing repository authorization in content_uploads exposes cross-product content existence

    Affected: fixed in 4.21.0.rc1.

  • CVE-2026-4324Medium 5.4

    Rubygem-katello: katello: denial of service and potential information disclosure via sql injection

    Affected: fixed in 4.19.1.

  • CVE-2019-14825Medium 4.1

    A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9.

    Affected: from 3.0.0.0, fixed in 3.12.2.

  • CVE-2018-16887Medium 5.4

    A cross-site scripting (XSS) flaw was found in the katello component of Satellite.

    Affected: fixed in 3.9.0.

  • CVE-2018-14623Medium 4.3

    A SQL injection flaw was found in katello's errata-related API.

    Affected: through 3.10.

  • CVE-2017-2662Medium 4.3

    A flaw was found in Foreman's katello plugin version 3.4.5.

    Affected: fixed in 3.17.0.rc1.

  • Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow…

    Affected: fixed in 2.4.3.

  • The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each…

    Affected: fixed in 1.0.6; from 1.1.0, fixed in 1.1.7.