-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
6.15.3, 6.16.0
-
2
-
False
-
-
False
-
rubygem-scoped_search-4.1.13
-
0
-
-
-
Low
-
None
Description:
A potential issue has been identified in the Red Hat Satellite tool where entering certain special characters (such as $ or &%) in the "Search Hosts" tab results in database-specific errors. While this is not a SQL injection vulnerability (as confirmed by our security architects), the presence of these characters renders an invalid SQL query. The input is correctly sanitized, but the error still affects user experience.
Steps to Reproduce:
Go to the "Search Hosts" tab in the Red Hat Satellite tool.
Enter special characters such as $ or &% in the search input.
Observe the resulting database-specific error.
Expected Outcome:
The search input should handle special characters gracefully without causing an invalid SQL query or error messages.
Actual Outcome:
The search input results in database-specific errors when special characters are entered.
Additional Notes:
The security team has confirmed that this is not a SQL injection but an issue related to query handling for special characters. Please review and implement a fix to ensure the tool behaves correctly in these scenarios.