Skip to content
Sign in Sign up
JA EN FR
SecPulse
A detailed explainer is available in Japanese. Read the Japanese explainer
Critical 9.6

Satellite 6のsafemodeに脆弱性、回避策あり

CVE-2026-107360 First seen on SecPulse

Summary

Red Hat Satellite 6のsafemodeに、テンプレート内のコードがサンドボックスの制限を回避できる脆弱性が見つかりました。Satellite 6を使う組織は、テンプレートの編集権限を信頼できる管理者に絞り、修正版の提供状況を確認してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

Red Hat Satellite 6のsafemodeに、テンプレート内のコードがサンドボックスの制限を回避できる脆弱性が見つかりました。Satellite 6を使う組織は、テンプレートの編集権限を信頼できる管理者に絞り、修正版の提供状況を確認してください。

Original description The description as published by the source.

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details