{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:63354",
        "url": "https://access.redhat.com/errata/RHSA-2026:63354"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67322",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67322"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67323",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67323"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67325",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67325"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63354.json"
      }
    ],
    "title": "Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image",
    "tracking": {
      "current_release_date": "2026-09-08T22:49:21+00:00",
      "generator": {
        "date": "2026-09-08T22:49:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.17"
        }
      },
      "id": "RHSA-2026:63354",
      "initial_release_date": "2026-09-03T21:00:38+00:00",
      "revision_history": [
        {
          "date": "2026-09-03T21:00:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-08T22:49:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.19",
                "product": {
                  "name": "Red Hat Satellite 6.19",
                  "product_id": "Red Hat Satellite 6.19",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.19::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-vmaas-rhel9@sha256%3A1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vmaas-rhel9\u0026tag=1788254161"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64 as a component of Red Hat Satellite 6.19",
          "product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.19"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-67322",
      "cwe": {
        "id": "CWE-214",
        "name": "Invocation of Process Using Visible Sensitive Information"
      },
      "discovery_date": "2026-08-01T13:03:21.499683+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510021"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clone_from() method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to exfiltrate sensitive environment variables, such as access keys or tokens, to an attacker-controlled server during the cloning process, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in GitPython allows for sensitive environment variable exfiltration. When an application utilizes GitPython\u0027s Repo.clone_from() method with an attacker-controlled Git repository URL, embedded environment variable tokens within the URL are expanded and transmitted to a remote server. This poses a risk of information disclosure, particularly for credentials or tokens, in Red Hat products that process untrusted clone URLs.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67322"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510021",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510021"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67322"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from"
        }
      ],
      "release_date": "2026-08-01T12:22:17.009000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T21:00:38+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63354"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that applications using GitPython\u0027s Repo.clone_from() method to clone from untrusted sources operate within a process environment that does not contain sensitive information as environment variables. Alternatively, implement strict validation and sanitization of all Git repository URLs before they are passed to Repo.clone_from() to prevent the inclusion of environment variable tokens. If the application is a service, a restart may be required for environment variable changes to take effect.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL"
    },
    {
      "cve": "CVE-2026-67323",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-08-01T13:00:55.807591+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509976"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive() and git.ls_remote(), potentially leading to arbitrary code execution. Additionally, functions such as Repo.iter_commits() and Repo.blame() do not validate revision arguments, which could allow an attacker to truncate arbitrary files. Exploitation requires an application to pass attacker-controlled input directly to these vulnerable methods.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability because it allows for arbitrary code execution or file truncation. The flaw in GitPython requires an application to process attacker-controlled input through specific GitPython methods, such as Repo.archive() or git.ls_remote(), to be exploited. This could lead to a compromise of confidentiality, integrity, and availability on affected Red Hat products that utilize GitPython in such a manner.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67323"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509976",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509976"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67323",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67323"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67323",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67323"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options"
        }
      ],
      "release_date": "2026-08-01T12:22:18.119000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T21:00:38+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63354"
        },
        {
          "category": "workaround",
          "details": "To mitigate the risk, ensure that applications utilizing GitPython are run within a sandboxed environment with minimal privileges. This limits the potential impact of arbitrary command execution or file truncation if an attacker successfully exploits the vulnerability through an application processing untrusted input. Review applications that interact with GitPython to ensure all input is properly sanitized and validated before being passed to methods such as Repo.archive(), git.ls_remote(), Repo.iter_commits(), or Repo.blame().",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options"
    },
    {
      "cve": "CVE-2026-67325",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-08-01T13:00:52.592125+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509975"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git\u0027s long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous options. This allows for the execution of arbitrary commands, leading to potential arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gitpython: GitPython: Command Injection via Git option prefix abbreviation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important as it allows for arbitrary command execution. It arises from an incomplete command injection blocklist in GitPython, which can be bypassed by supplying abbreviated Git options. This could lead to a complete compromise of confidentiality, integrity, and availability in Red Hat products that process untrusted input as keyword arguments to GitPython\u0027s Git commands.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67325"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509975",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509975"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67325",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67325"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67325",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67325"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation"
        }
      ],
      "release_date": "2026-08-01T12:22:16.817000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T21:00:38+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63354"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:1da7bcb73295d24c74d8ceeec334b345e9ed2dfdf0268e1bc1af33411aa7173a_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gitpython: GitPython: Command Injection via Git option prefix abbreviation"
    }
  ]
}