5.3Media
CVE-2026-12542Foreman: command injection in foreman-tail
Descripción
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
Debilidad (CWE):
CWE-78
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6 | all versions | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | all versions | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | all versions | |
| redhat | satellite | 6.16 – < 6.16.4 | |
| satellite | 6.16 | — | |
| satellite | 6.17 | — | |
| satellite | 6.18 | — | |
| satellite | 6.19 | — | |
| satellite capsule | 6.16 | — | |
| satellite capsule | 6.17 | — | |
| satellite capsule | 6.18 | — | |
| satellite capsule | 6.19 | — | |
| satellite utils | 6.16 | — | |
| satellite utils | 6.17 | — | |
| satellite utils | 6.18 | — | |
| satellite utils | 6.19 | — | |
| theforeman | foreman | 1.5.0 – ≤ 3.19.1 |
Referencias y parches
- RHSA-2026:74503 vendor-advisoryVendor Advisory
- RHSA-2026:74504 vendor-advisoryVendor Advisory
- RHSA-2026:74505 vendor-advisoryVendor Advisory
- RHSA-2026:74506 vendor-advisoryVendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-12542 vdb-entryVendor Advisory
- RHBZ#2489971 issue-trackingIssue TrackingVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/07/7 Mailing ListPatchThird Party Advisory
Coincidencias CPE (NVD) (7)
cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.16 < 6.16.4cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.17 < 6.17.12cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.5cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*≥ 1.5.0 ≤ 3.19.1cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.18 < 6.18.10cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*