Skip to content

[GHSA-jx5v-788g-qw58] katello SQL Injection vulnerability #10881

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jasnow wants to merge 2 commits into from
Closed

[GHSA-jx5v-788g-qw58] katello SQL Injection vulnerability #10881

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fda85cc
Improve GHSA-jx5v-788g-qw58
jasnow Nov 4, 2026
5a08ba0
Improve GHSA-jx5v-788g-qw58
jasnow Nov 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions advisories/github-reviewed/2022/05/GHSA-jx5v-788g-qw58/GHSA-jx5v-788g-qw58.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jx5v-788g-qw58",
"modified": "2023-01-27T00:01:21Z",
"modified": "2023-03-06T20:40:56Z",
"published": "2022-05-13T01:34:32Z",
"aliases": [
"CVE-2018-14623"
],
"summary": "katello SQL Injection vulnerability",
"details": "A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.",
"details": "A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072.",
"severity": [
{
"type": "CVSS_V3",
Expand All @@ -28,18 +28,25 @@
"introduced": "0"
},
{
"last_affected": "3.10"
"fixed": "3.6.0.rc1"
}
]
}
]
],
"database_specific": {
"last_known_affected_version_range": "<= 3.5.0.rc2"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14623"
},
{
"type": "WEB",
"url": "https://github.com/Katello/katello/commit/2e39affb47849ebd42f6974892e7618ed6c5dbd5"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0336"
Expand Down
Loading