CVE-2022-3874
Fixed in a distro release EPSS 2%CVSS 8.0
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
Products: Red Hat Satellite 6
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | foreman | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat satellite 6.12 | foreman | 0:3.3.0.23-1.el8sat |
| Red Hat satellite 6.12 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat satellite 6.12 | rubygem-git | 0:1.18.0-1.el8sat |
| Red Hat satellite 6.12 | rubygem-safemode | 0:1.3.8-1.el8sat |
| Red Hat satellite 6.12 | yggdrasil-worker-forwarder | 0:0.0.3-1.el8sat |
| Red Hat satellite 6.13 | foreman | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-cli | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-debug | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-dynflow-sidekiq | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-ec2 | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-journald | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-libvirt | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-openstack | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-ovirt | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-postgresql | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-service | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-telemetry | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | foreman-vmware | 0:3.5.1.23-1.el8sat |
| Red Hat satellite 6.13 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat satellite 6.13 | python-django | 0:3.2.21-1.el8pc |
| Red Hat satellite 6.13 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite 6.13 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat satellite 6.13 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite 6.13 | rubygem-git | 0:1.18.0-1.el8sat |
| Red Hat satellite 6.13 | yggdrasil-worker-forwarder | 0:0.0.3-1.el8sat |
| Red Hat satellite 6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-cli | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-debug | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-dynflow-sidekiq | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-ec2 | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-journald | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-libvirt | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-openstack | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-ovirt | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-postgresql | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-redis | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-service | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-telemetry | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-vmware | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat satellite 6.14 | puppetserver | 0:7.11.0-1.el8sat |
| Red Hat satellite 6.14 | python-django | 0:3.2.21-1.el8pc |
| Red Hat satellite 6.14 | python-future | 0:0.18.3-1.el8pc |
| Red Hat satellite 6.14 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite 6.14 | python-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat satellite 6.14 | python-requests | 0:2.31.0-1.el8pc |
| Red Hat satellite 6.14 | python-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat satellite 6.14 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat satellite 6.14 | python39-future | 0:0.18.3-1.el8pc |
| Red Hat satellite 6.14 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite 6.14 | python39-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat satellite 6.14 | python39-requests | 0:2.31.0-1.el8pc |
| Red Hat satellite 6.14 | python39-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat satellite 6.14 | rubygem-actionpack | 0:6.1.7.3-1.el8sat |
| Red Hat satellite 6.14 | rubygem-activerecord | 0:6.1.7.3-1.el8sat |
| Red Hat satellite 6.14 | rubygem-activesupport | 0:6.1.7.3-1.el8sat |
| Red Hat satellite 6.14 | rubygem-git | 0:1.18.0-1.el8sat |
| Red Hat satellite 6.14 | rubygem-globalid | 0:1.1.0-1.el8sat |
| Red Hat satellite 6.14 | rubygem-kubeclient | 0:4.10.1-1.el8sat |
| Red Hat satellite 6.14 | rubygem-rack | 0:2.2.7-1.el8sat |
| Red Hat satellite 6.14 | yggdrasil-worker-forwarder | 0:0.0.3-1.el8sat |
| Red Hat satellite capsule 6.12 | foreman | 0:3.3.0.23-1.el8sat |
| Red Hat satellite capsule 6.12 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat satellite capsule 6.13 | foreman | 0:3.5.1.23-1.el8sat |
| Red Hat satellite capsule 6.13 | foreman-debug | 0:3.5.1.23-1.el8sat |
| Red Hat satellite capsule 6.13 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat satellite capsule 6.13 | python-django | 0:3.2.21-1.el8pc |
| Red Hat satellite capsule 6.13 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite capsule 6.13 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat satellite capsule 6.13 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite capsule 6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat satellite capsule 6.14 | foreman-debug | 0:3.7.0.9-1.el8sat |
| Red Hat satellite capsule 6.14 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat satellite capsule 6.14 | puppetserver | 0:7.11.0-1.el8sat |
| Red Hat satellite capsule 6.14 | python-django | 0:3.2.21-1.el8pc |
| Red Hat satellite capsule 6.14 | python-future | 0:0.18.3-1.el8pc |
| Red Hat satellite capsule 6.14 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite capsule 6.14 | python-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat satellite capsule 6.14 | python-requests | 0:2.31.0-1.el8pc |
| Red Hat satellite capsule 6.14 | python-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-future | 0:0.18.3-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-requests | 0:2.31.0-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat satellite capsule 6.14 | rubygem-rack | 0:2.2.7-1.el8sat |
| Red Hat satellite utils 6.12 | foreman | 0:3.3.0.23-1.el8sat |
| Red Hat satellite utils 6.13 | foreman | 0:3.5.1.23-1.el8sat |
| Red Hat satellite utils 6.13 | foreman-cli | 0:3.5.1.23-1.el8sat |
| Red Hat satellite utils 6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat satellite utils 6.14 | foreman-cli | 0:3.7.0.9-1.el8sat |