Vulnerability in Red Hat Satellite 6.15 For Rhel 8
CVE-2024-4871
A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw…
EPSS: 0.030 (86.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Red Hat Satellite 6.15 For Rhel 8 — versions 0:4.3.14-1.el8sat, 0:3.9.1.8-1.el8sat, 1:3.9.3.2-1.el8sat
Weakness classification (CWE)
Public proof-of-concept exploits
References
- RHBA-2024:4589 (vendor-advisory, x_refsource_REDHAT)
- access.redhat.com/security/cve/CVE-2024-4871 (vdb-entry, x_refsource_REDHAT)
- RHBZ#2278627 (issue-tracking, x_refsource_REDHAT)
Frequently asked questions
- What is CVE-2024-4871?
- CVE-2024-4871 is a medium-severity vulnerability in Red Hat Satellite 6.15 For Rhel 8, classified under Key Exchange without Entity Authentication. CVSS score: 6.8/10. Published 2024-05-14.
- How severe is CVE-2024-4871?
- Medium severity. CVSS v3 base score is 6.8 out of 10.
- Is CVE-2024-4871 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.