From bbd11929d3b2b92a13183ec2887b5512f24e1e02 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sat, 7 Nov 2026 15:12:04 -0500 Subject: [PATCH 1/2] One new foreman_remote_execution advisory --- .../CVE-2026-12405.yml | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 gems/foreman_remote_execution/CVE-2026-12405.yml diff --git a/gems/foreman_remote_execution/CVE-2026-12405.yml b/gems/foreman_remote_execution/CVE-2026-12405.yml new file mode 100644 index 0000000000..297f6e14fd --- /dev/null +++ b/gems/foreman_remote_execution/CVE-2026-12405.yml @@ -0,0 +1,50 @@ +--- +gem: foreman_remote_execution +cve: 2026-12405 +ghsa: 9jhx-3c73-g9rh +url: https://nvd.nist.gov/vuln/detail/CVE-2026-12405 +title: Foreman_Remote_Execution - command injection via effective_user +date: 2026-10-01 +description: | + A flaw was found in rubygem-foreman_remote_execution. A command + injection vulnerability exists in the Red Hat Satellite API + (/api/v2/job_invocations). When a job template has the effective_user + property marked as overridable: true, the application fails to + properly sanitize the effective_user input provided during the + API request. The exploitation does not rely on the content or logic + of the Job Template/playbook itself; rather, the injection occurs + during the instantiation of the job execution environment by the + Satellite server. An attacker with permissions to execute job + templates can inject arbitrary shell commands into this parameter, + which are executed on the target infrastructure with the privileges + of the execution user. +cvss_v3: 8.8 +patched_versions: + - "~> 16.6.6" + - "~> 17.2.2" + - ">= 18.0.1" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-12405 + - https://rubygems.org/gems/foreman_remote_execution/versions/18.0.1 + - https://github.com/theforeman/foreman_remote_execution/compare/v18.0.0...v18.0.1 + - https://github.com/theforeman/foreman_remote_execution/pull/1072 + - https://rubygems.org/gems/foreman_remote_execution/versions/17.2.2 + - https://github.com/theforeman/foreman_remote_execution/compare/v17.2.1...v17.2.2 + - https://github.com/theforeman/foreman_remote_execution/pull/1074 + - https://rubygems.org/gems/foreman_remote_execution/versions/16.6.6 + - https://github.com/theforeman/foreman_remote_execution/compare/v16.6.5...v16.6.6 + - https://github.com/theforeman/foreman_remote_execution/pull/1073 + - https://projects.theforeman.org/issues/39836 + - https://access.redhat.com/errata/RHSA-2026:74503 + - https://access.redhat.com/security/cve/CVE-2026-12405 + - https://bugzilla.redhat.com/show_bug.cgi?id=2488952 + - https://access.redhat.com/errata/RHSA-2026:74504 + - https://access.redhat.com/errata/RHSA-2026:74506 + - https://access.redhat.com/errata/RHSA-2026:74505 + - http://www.openwall.com/lists/oss-security/2026/10/07/11 + - https://github.com/advisories/GHSA-9jhx-3c73-g9rh +notes: | + - cvss_v3 from nvd.nist.gov and GHSA URLs. + - date from GHSA URL. + - Unreviewed GHSA advisory From a9f1b08b99436f32318d9e70b7034ed77dc6dcff Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sat, 7 Nov 2026 15:16:18 -0500 Subject: [PATCH 2/2] Uprade GA python to 3.12 --- .github/workflows/ruby.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml index d83fbd9185..26cbe8b50a 100644 --- a/.github/workflows/ruby.yml +++ b/.github/workflows/ruby.yml @@ -36,7 +36,7 @@ jobs: - name: Set up Python uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: - python-version: 3.8 + python-version: 3.12 - name: Install yamllint run: | python -m pip install --upgrade pip