Red Hat Satellite: Mehrere Schwachstellen
WID-SEC-2023-1143 · first 04.05.2023 · updated 17.03.2026 · CVSS 9,8
What it is about
Red Hat Satellite dient als zentrale Stelle für das Management, die Verteilung von Updates in Netzwerken mit Red Hat Enterprise Linux Systemen. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder einen Denial of Service Zustand herbeizuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode auszuführen
- Informationen offenzulegen
- einen Cross-Site-Scripting-Angriff durchzuführen oder einen Denial of Service Zustand herbeizuführen
Am I affected?
Affected according to the BSI:
- Debian Linux
- Fedora Linux
- Red Hat Satellite <6.13
- SUSE openSUSE
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Red Hat Satellite 6.13
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Red Hat Security Advisory RHSA-2023:2097 vom 2023-05-03 access.redhat.com
- Debian Security Advisory DLA-3566 vom 2023-09-13 lists.debian.org
- Debian Security Advisory DLA-3565 vom 2023-09-13 lists.debian.org
- Fedora Security Advisory FEDORA-2023-1BBEA3700B vom 2023-11-23 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2023-91E69EA326 vom 2023-11-23 bodhi.fedoraproject.org
- Debian Security Advisory DLA-3901 vom 2024-09-28 lists.debian.org
- openSUSE Security Update OPENSUSE-SU-2025:15120-1 vom 2025-05-18 lists.opensuse.org
- openSUSE Security Update OPENSUSE-SU-2025:15125-1 vom 2025-05-18 lists.opensuse.org
- openSUSE Security Update OPENSUSE-SU-2026:10353-1 vom 2026-03-16 lists.opensuse.org
CVE: CVE-2022-1471, CVE-2022-22577, CVE-2022-23514, CVE-2022-23515, CVE-2022-23516, CVE-2022-23517, CVE-2022-23518, CVE-2022-23519, CVE-2022-23520, CVE-2022-25857, CVE-2022-27777, CVE-2022-31163, CVE-2022-32224, CVE-2022-33980, CVE-2022-38749, CVE-2022-38750, CVE-2022-38751, CVE-2022-38752, CVE-2022-41323, CVE-2022-41946 …
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.