rhsa-2024_8906
Vulnerability from csaf_redhat
Published
2024-11-05 17:49
Modified
2024-11-06 14:08
Summary
Red Hat Security Advisory: Satellite 6.16.0 release
Notes
Topic
A new release is now available for Red Hat Satellite 6.16 for RHEL 8 and 9.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.
Security Fix(es):
* mosquitto: sending specific sequences of packets may trigger memory leak
(CVE-2024-8376)
* micromatch: vulnerable to Regular Expression Denial of Service (CVE-2024-4067)
urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)
* python-django: Potential denial-of-service in django.utils.html.urlize() (CVE-2024-38875)
* python-django: Username enumeration through timing difference for users with unusable passwords (CVE-2024-39329)
* python-django: Potential directory-traversal in django.core.files.storage.Storage.save() (CVE-2024-39330)
* python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant() (CVE-2024-39614)
* github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp (CVE-2024-5569)
* puppet-foreman: An authentication bypass vulnerability exists in Foreman (CVE-2024-7012)
* python-django: Potential SQL injection in QuerySet.values() and values_list() (CVE-2024-42005)
* grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the backend (CVE-2024-7246)
* puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore (CVE-2024-7923)
* foreman: Read-only access to entire DB from templates (CVE-2024-8553)
Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.