{"id":"CVE-2018-14623","details":"A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.","aliases":["GHSA-jx5v-788g-qw58"],"modified":"2026-10-24T10:30:16.074900129Z","published":"2018-12-14T00:29:01.127Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:theforeman:katello:*:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"3.10.0"}],"source":"CPE_RANGE"}],"vendor_product":"theforeman:katello"}]},"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/106224"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14623"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/katello/katello","events":[{"introduced":"0"},{"last_affected":"7791607f423c77f9146447d892a7d87fa4d4ce32"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"3.10"}],"source":"DESCRIPTION"}]}}],"versions":["3.10.0","3.10.0.rc1.1","3.10.0.rc1","2.4.0-RC1","rubygem-katello-2.4.0-2","rubygem-katello-2.4.0-1","rubygem-katello-2.3.0-2","katello-2.3.0-1","rubygem-katello-2.3.0-1","rubygem-katello-2.2.0-2","katello-2.2.0-1","rubygem-katello-2.2.0-1","rubygem-katello-1.5.0-11","rubygem-katello-2.0.0-1","katello-2.1.0-1","rubygem-katello-2.1.0-1","katello-2.0.0-0","rubygem-katello-1.5.0-12","rubygem-katello-1.5.0-10","katello-1.5.0-14","katello-1.5.0-13","katello-1.5.0-12","rubygem-katello-1.5.0-9","katello-1.4.9-1","katello-1.5.1-1","katello-1.4.7-1","katello-1.4.8-1","katello-1.4.6-1","katello-1.4.5-1","katello-1.4.4-1","katello-1.4.3-1","katello-1.4.2-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14623.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}