Refine your search

1 vulnerability found for Red Hat Satellite 6.19 for RHEL 9 by Red Hat

CVE-2026-4324 (GCVE-0-2026-4324)
Vulnerability from cvelistv5
Published
2026-03-17 13:52
Modified
2026-06-01 17:33
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary
A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.
References
https://access.redhat.com/errata/RHSA-2026:22326 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5968 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5970 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-4324 vdb-entry, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2448349 issue-tracking, x_refsource_REDHAT
Impacted products
Vendor Product Version
Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:3.14.0.14-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.1.23-0.3.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:1.2.0-0.1.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:4.2.28-0.1.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:2.22.3-1.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:3.27.10-2.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:1.5.1-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.4.3-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:4.16.0.14-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.13.0-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:6.17.7-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.0.3-4.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:3.14.0.14-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.1.23-0.3.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:1.2.0-0.1.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:4.2.28-0.1.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:2.22.3-1.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:3.27.10-2.el9pc   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:1.5.1-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.4.3-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:4.16.0.14-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.13.0-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:6.17.7-1.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.0.3-4.el9sat   < *
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.18 for RHEL 9 Unaffected: 0:4.18.0.9-1.el9sat   < *
    cpe:/a:redhat:satellite:6.18::el9
    cpe:/a:redhat:satellite_capsule:6.18::el9
    cpe:/a:redhat:satellite_utils:6.18::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6.19 for RHEL 9 Unaffected: 0:4.20.0.4-1.el9sat   < *
    cpe:/a:redhat:satellite:6.19::el9
    cpe:/a:redhat:satellite_capsule:6.19::el9
    cpe:/a:redhat:satellite_maintenance:6.19::el9
    cpe:/a:redhat:satellite_utils:6.19::el9
Create a notification for this product.
   Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4324",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T14:26:51.385589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-17T14:26:57.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.14.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "libcomps",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.1.23-0.3.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-brotli",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.2.0-0.1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-django",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.2.28-0.1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulp-container",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.22.3-1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulp-rpm",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.27.10-2.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-fog-kubevirt",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.5.1-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-foreman_kubevirt",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.4.3-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-katello",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.16.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-rubyipmi",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.13.0-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "satellite",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.17.7-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "yggdrasil-worker-forwarder",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.0.3-4.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.14.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "libcomps",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.1.23-0.3.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-brotli",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.2.0-0.1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-django",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.2.28-0.1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulp-container",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.22.3-1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulp-rpm",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.27.10-2.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-fog-kubevirt",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.5.1-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-foreman_kubevirt",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.4.3-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-katello",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.16.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-rubyipmi",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.13.0-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "satellite",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.17.7-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "yggdrasil-worker-forwarder",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.0.3-4.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.18::el9",
            "cpe:/a:redhat:satellite_capsule:6.18::el9",
            "cpe:/a:redhat:satellite_utils:6.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-katello",
          "product": "Red Hat Satellite 6.18 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.18.0.9-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.19::el9",
            "cpe:/a:redhat:satellite_capsule:6.19::el9",
            "cpe:/a:redhat:satellite_maintenance:6.19::el9",
            "cpe:/a:redhat:satellite_utils:6.19::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-katello",
          "product": "Red Hat Satellite 6.19 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.20.0.4-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "satellite:el8/rubygem-katello",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-03-17T13:18:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T17:33:36.979Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:22326",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:22326"
        },
        {
          "name": "RHSA-2026:5968",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5968"
        },
        {
          "name": "RHSA-2026:5970",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5970"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-4324"
        },
        {
          "name": "RHBZ#2448349",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448349"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-17T12:28:40.127Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-03-17T13:18:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Rubygem-katello: katello: denial of service and potential information disclosure via sql injection",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-4324",
    "datePublished": "2026-03-17T13:52:14.756Z",
    "dateReserved": "2026-03-17T12:30:29.903Z",
    "dateUpdated": "2026-06-01T17:33:36.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}