CVE-2026-4324 Rubygem-katello: katello: denial of service and potential information disclosure via sql injection
A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.18 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite_utils:6.18::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.19 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.19::el9
cpe:/a:redhat:satellite_capsule:6.19::el9
cpe:/a:redhat:satellite_maintenance:6.19::el9
cpe:/a:redhat:satellite_utils:6.19::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2026-03-17T13:52:14.756Z