CVE-2025-10622
Fixed in a distro release EPSS <1%CVSS 8.0
A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.
Products: The Foreman Foreman, Red Hat Satellite 6.15 for RHEL 8, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9, Red Hat Satellite 6
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat satellite 6.15 | foreman | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-cli | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-debug | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-dynflow-sidekiq | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-ec2 | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-journald | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-libvirt | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-openstack | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-ovirt | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-pcp | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-postgresql | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-redis | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-service | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-telemetry | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-vmware | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | rubygem-rack | 0:2.2.20-1.el8sat |
| Red Hat satellite 6.16 | foreman | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-cli | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-cli | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-debug | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-debug | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-dynflow-sidekiq | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-dynflow-sidekiq | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-ec2 | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-ec2 | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-journald | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-journald | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-libvirt | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-libvirt | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-openstack | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-openstack | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-ovirt | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-ovirt | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-pcp | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-pcp | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-postgresql | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-postgresql | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-redis | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-redis | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-service | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-service | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-telemetry | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-telemetry | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-vmware | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-vmware | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | rubygem-rack | 0:2.2.20-1.el9sat |
| Red Hat satellite 6.16 | rubygem-rack | 0:2.2.20-1.el8sat |
| Red Hat satellite 6.17 | foreman | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-cli | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-debug | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-dynflow-sidekiq | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-ec2 | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-journald | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-libvirt | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-openstack | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-ovirt | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-pcp | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-postgresql | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-redis | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-service | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-telemetry | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-vmware | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | rubygem-rack | 0:2.2.20-1.el9sat |
| Red Hat satellite 6.18 | foreman | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-cli | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-debug | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-dynflow-sidekiq | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-ec2 | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-journald | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-libvirt | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-openstack | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-pcp | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-postgresql | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-redis | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-service | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-telemetry | 0:3.16.0.4-1.el9sat |
| Red Hat satellite 6.18 | foreman-vmware | 0:3.16.0.4-1.el9sat |
| Red Hat satellite capsule 6.15 | foreman | 0:3.9.1.13-1.el8sat |
| Red Hat satellite capsule 6.15 | foreman-debug | 0:3.9.1.13-1.el8sat |
| Red Hat satellite capsule 6.15 | foreman-pcp | 0:3.9.1.13-1.el8sat |
| Red Hat satellite capsule 6.15 | rubygem-rack | 0:2.2.20-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman | 0:3.12.0.11-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman | 0:3.12.0.11-1.el9sat |
| Red Hat satellite capsule 6.16 | foreman-debug | 0:3.12.0.11-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman-debug | 0:3.12.0.11-1.el9sat |
| Red Hat satellite capsule 6.16 | foreman-pcp | 0:3.12.0.11-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman-pcp | 0:3.12.0.11-1.el9sat |
| Red Hat satellite capsule 6.16 | rubygem-rack | 0:2.2.20-1.el9sat |
| Red Hat satellite capsule 6.16 | rubygem-rack | 0:2.2.20-1.el8sat |
| Red Hat satellite capsule 6.17 | foreman | 0:3.14.0.10-1.el9sat |
| Red Hat satellite capsule 6.17 | foreman-debug | 0:3.14.0.10-1.el9sat |
| Red Hat satellite capsule 6.17 | foreman-pcp | 0:3.14.0.10-1.el9sat |
| Red Hat satellite capsule 6.17 | rubygem-rack | 0:2.2.20-1.el9sat |
| Red Hat satellite capsule 6.18 | foreman | 0:3.16.0.4-1.el9sat |
| Red Hat satellite capsule 6.18 | foreman-debug | 0:3.16.0.4-1.el9sat |
| Red Hat satellite capsule 6.18 | foreman-pcp | 0:3.16.0.4-1.el9sat |
| Red Hat satellite utils 6.15 | foreman | 0:3.9.1.13-1.el8sat |
| Red Hat satellite utils 6.15 | foreman-cli | 0:3.9.1.13-1.el8sat |
| Red Hat satellite utils 6.16 | foreman | 0:3.12.0.11-1.el9sat |
| Red Hat satellite utils 6.16 | foreman | 0:3.12.0.11-1.el8sat |
| Red Hat satellite utils 6.16 | foreman-cli | 0:3.12.0.11-1.el9sat |
| Red Hat satellite utils 6.16 | foreman-cli | 0:3.12.0.11-1.el8sat |
| Red Hat satellite utils 6.17 | foreman | 0:3.14.0.10-1.el9sat |
| Red Hat satellite utils 6.17 | foreman-cli | 0:3.14.0.10-1.el9sat |
| Red Hat satellite utils 6.18 | foreman | 0:3.16.0.4-1.el9sat |
| Red Hat satellite utils 6.18 | foreman-cli | 0:3.16.0.4-1.el9sat |