CVE-2019-3845

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-11 · updated 2026-06-17
Weakness: CWE-284

Description

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

Affected products

Red Hat Satellite 6: before 6.2 — fixed in 6.2

How to fix

Upgrade to a fixed version: Red Hat Satellite 6 6.2. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2019:1223
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3845
https://access.redhat.com/errata/RHSA-2019:1223
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3845

Get alerted when CVE-2019-3845 or the next vulnerability affects your stack