A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.

A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.

rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter foreman: unauthenticated information disclosure via provisioning token validation flaw foreman: command injection in foreman-rake errors:fetch_log via request_id parameter foreman: command injection in foreman-rake database tasks foreman: command injection in foreman-tail foreman: SSTI and insecure deserialization in foreman-rake configuration rubygem-hammer_cli: command injection via insecure editor invocation dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header postcss: PostCSS: Information disclosure and denial of service via crafted CSS input sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing rubygem-katello: SQL injection in Registry Proxy via labels rubygem-katello: improper authorization logic allows resource enumeration html/template: golang: Go html/template: Cross-Site Scripting via pathological input net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations sqlparse: sqlparse: Denial of Service v…