Project

General

Profile

Actions
Copy link

Bug #39440

closed

content_uploads_controller does not filter repository context by "editable"

Added by Ian Ballou about 2 months ago. Updated about 20 hours ago.

Status:
Closed
Priority:
Normal
Assignee:
Ian Ballou
Category:
Repositories
Target version:
Katello 4.21.1
Difficulty:
easy
Triaged:
Yes
Bugzilla link:
Pull request:
https://github.com/Katello/katello/pull/11786
Fixed in Releases:
Katello 5.0.0, Katello 4.21.1
Found in Releases:
Red Hat JIRA:

Description

The content uploads controller lets a user with repo edit permissions see repositories potentially outside of their editable view:

https://github.com/katello/katello/blob/8e832b569a06c060a4a960a88da95e831b33f1e3/app/controllers/katello/api/v2/content_uploads_controller.rb#L54

See https://app.opencve.io/cve/CVE-2026-12515

The fix for this issue should also provide a unit test to ensure that the permission limiting fix does not regress.

Actions
Copy link
 #1

Updated by The Foreman Bot about 2 months ago

  • Status changed from New to Ready For Testing
  • Assignee set to Ian Ballou
  • Pull request https://github.com/Katello/katello/pull/11786 added
Actions
Copy link
 #2

Updated by Ian Ballou about 1 month ago

  • Target version set to Katello 4.21.1
  • Triaged changed from No to Yes
Actions
Copy link
 #3

Updated by The Foreman Bot about 1 month ago

  • Fixed in Releases Katello 5.0.0 added
Actions
Copy link
 #4

Updated by Anonymous about 1 month ago

  • Status changed from Ready For Testing to Closed
Actions
Copy link
 #5

Updated by The Foreman Bot about 20 hours ago

  • Fixed in Releases Katello 4.21.1 added
Actions
Copy link

Also available in: Atom PDF