katello 3.16.1

2 security vulnerabilities found in version 3.16.1

katello SQL Injection vulnerability

medium severity CVE-2018-14623
medium severity CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.

katello Improper Privilege Management vulnerability

medium severity CVE-2017-2662
medium severity CVE-2017-2662
Patched versions: >= 3.17.0.rc1

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

No license issues detected.


This gem version has a license in the gemspec.

This gem version is available.


This gem version has not been yanked and is still available for usage.