RHEL 6 : Satellite Server (RHSA-2015:0033)
Low Nessus Plugin ID 80505
SynopsisThe remote Red Hat host is missing one or more security updates.
DescriptionRed Hat Satellite 5.7.0 is now available. Updated packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Satellite 5.
Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Red Hat Satellite provides a solution to organizations requiring absolute control over and privacy of the maintenance and package deployment of their servers. It allows organizations to utilize the benefits of Red Hat Network (RHN) without having to provide public Internet access to their servers or other client systems.
This update introduces Red Hat Satellite 5.7.0. For the full list of new features included in this release, see the Release Notes document at :
Note: Red Hat Satellite 5.7 and Red Hat Satellite Proxy 5.7 are available for installation on Red Hat Enterprise Linux Server 6. For full details, including supported architecture combinations, refer to the Red Hat Satellite 5.7 Installation Guide.
This update fixes the following security issues :
Multiple stored cross-site scripting (XSS) flaw were found in the handling of XML data passed to Satellite via the REST API. By sending a specially crafted request to Satellite, a remote, authenticated attacker could embed HTML content into the stored data, allowing them to inject malicious content into the web page that is used to view that data. (CVE-2014-7811)
A stored cross-site scripting (XSS) flaw was found in the System Groups field. By sending a specially crafted request to Satellite, a remote, authenticated attacker could embed HTML content into the stored data, allowing them to inject malicious content into the web page that is used to view that data. (CVE-2014-7812)
Red Hat would like to thank Mickael Gallier for reporting these issues.
All users of Red Hat Satellite are advised to install this newly released version.
SolutionUpdate the affected packages.