6.7Media
CVE-2026-12545Rubygem-hammer_cli: command injection via insecure editor invocation
Descripción
A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).
Debilidad (CWE):
CWE-78
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6 | all versions | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | all versions | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | all versions | |
| satellite | 6.16 | — | |
| satellite | 6.17 | — | |
| satellite | 6.18 | — | |
| satellite | 6.19 | — | |
| satellite capsule | 6.16 | — | |
| satellite capsule | 6.17 | — | |
| satellite capsule | 6.18 | — | |
| satellite capsule | 6.19 | — | |
| satellite utils | 6.16 | — | |
| satellite utils | 6.17 | — | |
| satellite utils | 6.18 | — | |
| satellite utils | 6.19 | — |
Referencias y parches
- RHSA-2026:74503 vendor-advisory
- RHSA-2026:74504 vendor-advisory
- RHSA-2026:74505 vendor-advisory
- RHSA-2026:74506 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-12545 vdb-entry
- RHBZ#2489993 issue-tracking
- http://www.openwall.com/lists/oss-security/2026/10/07/5