Back

MEDIUM

katello: SQL inject in errata-related REST API

Published Dec 13, 2018

Description

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.

Affected products

Remediation

No remediation recorded yet.

Metrics

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Dec 13, 2018
Updated Aug 5, 2024
Reserved Jul 27, 2018
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Low
Public date Dec 12, 2018
GHSA-JX5V-788G-QW58