title: Arbitrary code execution through templates
description: An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
problem types: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
product: foreman
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Satellite 6.13 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rubygem-safemode
defaultStatus: affected
versions:
version: 0:1.3.8-1.el8sat, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:satellite:6.13::el8, cpe:/a:redhat:satellite_utils:6.13::el8, cpe:/a:redhat:satellite_capsule:6.13::el8, cpe:/a:redhat:satellite_maintenance:6.13::el8]
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]