RHSA-2015:0033 - Security Advisory

Topic

Red Hat Satellite 5.7.0 is now available. Updated packages that fix two
security issues, several bugs, and add various enhancements are now
available for Red Hat Satellite 5.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

Red Hat Satellite provides a solution to organizations requiring absolute
control over and privacy of the maintenance and package deployment of their
servers. It allows organizations to utilize the benefits of Red Hat Network
(RHN) without having to provide public Internet access to their servers or
other client systems.

This update introduces Red Hat Satellite 5.7.0. For the full list of new
features included in this release, see the Release Notes document at:

https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/5.7/

Note: Red Hat Satellite 5.7 and Red Hat Satellite Proxy 5.7 are available
for installation on Red Hat Enterprise Linux Server 6. For full details,
including supported architecture combinations, refer to the Red Hat
Satellite 5.7 Installation Guide.

This update fixes the following security issues:

Multiple stored cross-site scripting (XSS) flaw were found in the handling
of XML data passed to Satellite via the REST API. By sending a specially
crafted request to Satellite, a remote, authenticated attacker could embed
HTML content into the stored data, allowing them to inject malicious
content into the web page that is used to view that data.
(CVE-2014-7811)

A stored cross-site scripting (XSS) flaw was found in the System Groups
field. By sending a specially crafted request to Satellite, a remote,
authenticated attacker could embed HTML content into the stored data,
allowing them to inject malicious content into the web page that is used to
view that data. (CVE-2014-7812)

Red Hat would like to thank Mickaël Gallier for reporting these issues.

All users of Red Hat Satellite are advised to install this newly released
version.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 5.7 x86_64
• Red Hat Satellite 5.7 s390x
• Red Hat Satellite 5 Managed DB 5.7 x86_64
• Red Hat Satellite 5 Managed DB 5.7 s390x

Fixes

• BZ - 1156299 - CVE-2014-7811 Red Hat Satellite, Spacewalk: multiple XSS
• BZ - 1172934 - CVE-2014-7812 Red Hat Satellite, Spacewalk: XSS in system-group

CVEs

• CVE-2014-7811
• CVE-2014-7812

References

• http://www.redhat.com/security/updates/classification/#normal