RHSA-2026:63337
Vulnerability from csaf_redhat - Published: 2026-09-03 20:43 - Updated: 2026-09-11 01:48Summary
Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
Severity
Important
Notes
Topic: A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.
Details: Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Low
A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clone_from() method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to exfiltrate sensitive environment variables, such as access keys or tokens, to an attacker-controlled server during the cloning process, leading to information disclosure.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive() and git.ls_remote(), potentially leading to arbitrary code execution. Additionally, functions such as Repo.iter_commits() and Repo.blame() do not validate revision arguments, which could allow an attacker to truncate arbitrary files. Exploitation requires an application to pass attacker-controlled input directly to these vulnerable methods.
8.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous options. This allows for the execution of arbitrary commands, leading to potential arbitrary code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before the entire body is received. This leaves trailing data to be processed incorrectly, potentially enabling an attacker to bypass security mechanisms or gain unauthorized access to resources.
7.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit this to trigger a Denial of Service (DoS) in the client application, making it unavailable.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
59 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services. ",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:63337",
"url": "https://access.redhat.com/errata/RHSA-2026:63337"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48710",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67322",
"url": "https://access.redhat.com/security/cve/CVE-2026-67322"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67323",
"url": "https://access.redhat.com/security/cve/CVE-2026-67323"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67325",
"url": "https://access.redhat.com/security/cve/CVE-2026-67325"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69243",
"url": "https://access.redhat.com/security/cve/CVE-2026-69243"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69244",
"url": "https://access.redhat.com/security/cve/CVE-2026-69244"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63337.json"
}
],
"title": "Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview",
"tracking": {
"current_release_date": "2026-09-11T01:48:35+00:00",
"generator": {
"date": "2026-09-11T01:48:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:63337",
"initial_release_date": "2026-09-03T20:43:08+00:00",
"revision_history": [
{
"date": "2026-09-03T20:43:08+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-11T01:48:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.19",
"product": {
"name": "Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.19::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64",
"product": {
"name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64",
"product_id": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/iop-vulnerability-engine-rhel9@sha256%3A18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vulnerability-engine-rhel9\u0026tag=1788190224"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64 as a component of Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
},
"product_reference": "registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64",
"relates_to_product_reference": "Red Hat Satellite 6.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-48710",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-26T23:01:03.204374+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481742"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The impact of this vulnerability is rated Moderate. A malformed Host header can manipulate the reconstructed request.url.path, introducing a discrepancy with the canonical ASGI request path (scope[\"path\"]). However, the vulnerability does not directly grant access, modify routing, or bypass security controls on its own. A path-based authentication or authorization bypass is possible only if an application depends on request.url.path for access control decisions rather than the canonical ASGI path or standard framework mechanisms. The impact relies heavily on downstream application design rather than a default library failure.\n\nRed Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. \n\nOpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application.\n\nRHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn\u0027t expose any endpoint.\n\nRHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it\u0027s transient dependency and starlette is not used at all to serve any endpoints.\n\nRHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "RHBZ#2481742",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://badhost.org",
"url": "https://badhost.org"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
"url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
},
{
"category": "external",
"summary": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
},
{
"category": "external",
"summary": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
"url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
},
{
"category": "external",
"summary": "https://www.secwest.net/starlette",
"url": "https://www.secwest.net/starlette"
},
{
"category": "external",
"summary": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2026-05-26T21:54:54.393000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T20:43:08+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63337"
},
{
"category": "workaround",
"details": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2026-09-02T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Low"
}
],
"title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header"
},
{
"cve": "CVE-2026-67322",
"cwe": {
"id": "CWE-214",
"name": "Invocation of Process Using Visible Sensitive Information"
},
"discovery_date": "2026-08-01T13:03:21.499683+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510021"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clone_from() method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to exfiltrate sensitive environment variables, such as access keys or tokens, to an attacker-controlled server during the cloning process, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in GitPython allows for sensitive environment variable exfiltration. When an application utilizes GitPython\u0027s Repo.clone_from() method with an attacker-controlled Git repository URL, embedded environment variable tokens within the URL are expanded and transmitted to a remote server. This poses a risk of information disclosure, particularly for credentials or tokens, in Red Hat products that process untrusted clone URLs.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67322"
},
{
"category": "external",
"summary": "RHBZ#2510021",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510021"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67322"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67322",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67322"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from",
"url": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from"
}
],
"release_date": "2026-08-01T12:22:17.009000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T20:43:08+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63337"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that applications using GitPython\u0027s Repo.clone_from() method to clone from untrusted sources operate within a process environment that does not contain sensitive information as environment variables. Alternatively, implement strict validation and sanitization of all Git repository URLs before they are passed to Repo.clone_from() to prevent the inclusion of environment variable tokens. If the application is a service, a restart may be required for environment variable changes to take effect.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL"
},
{
"cve": "CVE-2026-67323",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-08-01T13:00:55.807591+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509976"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive() and git.ls_remote(), potentially leading to arbitrary code execution. Additionally, functions such as Repo.iter_commits() and Repo.blame() do not validate revision arguments, which could allow an attacker to truncate arbitrary files. Exploitation requires an application to pass attacker-controlled input directly to these vulnerable methods.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability because it allows for arbitrary code execution or file truncation. The flaw in GitPython requires an application to process attacker-controlled input through specific GitPython methods, such as Repo.archive() or git.ls_remote(), to be exploited. This could lead to a compromise of confidentiality, integrity, and availability on affected Red Hat products that utilize GitPython in such a manner.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67323"
},
{
"category": "external",
"summary": "RHBZ#2509976",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509976"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67323"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67323",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67323"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options",
"url": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options"
}
],
"release_date": "2026-08-01T12:22:18.119000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T20:43:08+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63337"
},
{
"category": "workaround",
"details": "To mitigate the risk, ensure that applications utilizing GitPython are run within a sandboxed environment with minimal privileges. This limits the potential impact of arbitrary command execution or file truncation if an attacker successfully exploits the vulnerability through an application processing untrusted input. Review applications that interact with GitPython to ensure all input is properly sanitized and validated before being passed to methods such as Repo.archive(), git.ls_remote(), Repo.iter_commits(), or Repo.blame().",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options"
},
{
"cve": "CVE-2026-67325",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-01T13:00:52.592125+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509975"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git\u0027s long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous options. This allows for the execution of arbitrary commands, leading to potential arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gitpython: GitPython: Command Injection via Git option prefix abbreviation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important as it allows for arbitrary command execution. It arises from an incomplete command injection blocklist in GitPython, which can be bypassed by supplying abbreviated Git options. This could lead to a complete compromise of confidentiality, integrity, and availability in Red Hat products that process untrusted input as keyword arguments to GitPython\u0027s Git commands.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67325"
},
{
"category": "external",
"summary": "RHBZ#2509975",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509975"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67325"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67325",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67325"
},
{
"category": "external",
"summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx",
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation",
"url": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation"
}
],
"release_date": "2026-08-01T12:22:16.817000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T20:43:08+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63337"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gitpython: GitPython: Command Injection via Git option prefix abbreviation"
},
{
"cve": "CVE-2026-69243",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-03T22:02:56.444781+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510831"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before the entire body is received. This leaves trailing data to be processed incorrectly, potentially enabling an attacker to bypass security mechanisms or gain unauthorized access to resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. This vulnerability in aiohttp\u0027s HTTP parser enables request smuggling when the server-side component handles WebSocket upgrade requests containing a body. An attacker could exploit an edge case during protocol switching, causing trailing data to be processed as subsequent requests or upgraded protocol data. This affects Red Hat products utilizing aiohttp in a server-side capacity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69243"
},
{
"category": "external",
"summary": "RHBZ#2510831",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510831"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69243"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98",
"url": "https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/pull/13017",
"url": "https://github.com/aio-libs/aiohttp/pull/13017"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2",
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"
}
],
"release_date": "2026-08-03T20:45:43.406000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T20:43:08+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63337"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade"
},
{
"cve": "CVE-2026-69244",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-08-03T22:02:32.583060+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510825"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit this to trigger a Denial of Service (DoS) in the client application, making it unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important severity flaw in aiohttp that could lead to a denial of service in client applications. A remote, malicious HTTP server could send a specially crafted response, causing an out-of-bounds read in the aiohttp C response parser and resulting in the client application terminating unexpectedly.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69244"
},
{
"category": "external",
"summary": "RHBZ#2510825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510825"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69244"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69244",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69244"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d",
"url": "https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/pull/13223",
"url": "https://github.com/aio-libs/aiohttp/pull/13223"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3",
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"
}
],
"release_date": "2026-08-03T20:50:59.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-03T20:43:08+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:63337"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…