CVE-2018-14623

Vulnerability

A SQL injection flaw exists in Katello's errata-related API. The vulnerability allows an authenticated remote attacker to craft input data that, when processed by the errata API, forces the generation of a malformed SQL query to the backend database. This issue is an incomplete fix for CVE-2016-3072. Katello version 3.10 and older are vulnerable [1][2][3].

Exploitation

An attacker must have valid authentication to the Katello/Satellite system. By sending a specially crafted request to the errata-related API endpoint, the attacker can inject SQL commands that are executed by the backend database. No user interaction beyond initial authentication is required; the attacker directly manipulates the API input [1][2][3].

Impact

Successful exploitation results in leakage of internal database identifiers. The primary impact is confidentiality loss of internal IDs, which could aid further attacks. The attacker does not gain the ability to modify or delete data, nor achieve remote code execution directly from this vulnerability [1][2][3].

Mitigation

The vulnerability is addressed in Red Hat Satellite 6.3, released as part of RHSA-2018:0336. Users are advised to upgrade to Satellite 6.3 or apply the relevant security update to their Katello packages. For Satellite versions prior to 6.3, no workarounds have been published by Red Hat [1][2].