CVE-2019-3845

Se encontró una falta de control de acceso en las colas de mensajes mantenidas por el broker QPID de Satellite y usadas por katello-agent en versiones anteriores a Satellite 6.2, Satellite 6.1 opcional y Satellite Capsule 6.1. Un usuario malintencionado autenticado en un host registrado en Satellite (o Capsule) puede usar este fallo para acceder a los métodos de QMF en cualquier host también registrado en Satellite (o Capsule) y ejecutar comandos privilegiados.

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. This update provides the Satellite 6.5 Tools repositories. For the full list of new features provided by Satellite 6.5, see the Release Notes linked to in the references section. See the Satellite 6 Installation Guide for detailed instructions on how to install a new Satellite 6.5 environment, or the Satellite 6 Upgrading and Updating guide for detailed instructions on how to upgrade from prior versions of Satellite 6.