Red Hat Satellite, a system management solution for provisioning and configuration management, has two authentication bypass vulnerabilities identified as CVE-2024-7012 in Foreman and CVE-2024-7923 in Pulpcore. These issues allow bypassing authentication mechanisms, potentially enabling unauthorized access to system management functions. Red Hat has released updated packages in Satellite 6.14.4.2 to fix these vulnerabilities. The advisory RHSA-2024:6336 recommends upgrading to these versions to mitigate the security risks. The vulnerabilities are categorized under CWE-287 (Improper Authentication).

Successful exploitation of these authentication bypass vulnerabilities could allow attackers to gain unauthorized access to Red Hat Satellite management functions, potentially compromising system provisioning and configuration management. This could lead to unauthorized system changes or data exposure within managed environments. The vulnerabilities affect critical components responsible for system management, increasing the risk level.

Red Hat has released updated packages in Red Hat Satellite 6.14.4.2 that fix these authentication bypass vulnerabilities. Users should apply this security update promptly. Before applying the update, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available in the Red Hat Satellite documentation. No alternative mitigations are specified, and the update is the recommended remediation.