CVE-2016-3072
Fixed in a distro release EPSS 2%
Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.
Products: katello, redhat satellite
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | katello | 2.4.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat satellite 6.1 | ruby193-rubygem-katello | 0:2.2.0.86-1.el6_6sat |
| Red Hat satellite 6.1 | ruby193-rubygem-katello | 0:2.2.0.86-1.el7sat |