Information Exposure Affecting katello package, versions <3.1.0.rc1
Threat Intelligence
EPSS
0.06% (25th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-KATELLO-3251727
- published 31 Jan 2023
- disclosed 13 May 2022
- credit Mohamed Tehami
How to fix?
Upgrade katello to version 3.1.0.rc1 or higher.
Overview
katello is a package that adds Content and Subscription Management to Foreman
Affected versions of this package are vulnerable to Information Exposure via an errata-related API. An authenticated user can expose internal IDs. This is caused by an incomplete fix for CVE-2016-3072.
References
CVSS Scores
version 3.1