{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:79372",
        "url": "https://access.redhat.com/errata/RHSA-2026:79372"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78677",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78677"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79372.json"
      }
    ],
    "title": "Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image",
    "tracking": {
      "current_release_date": "2026-10-09T00:50:06+00:00",
      "generator": {
        "date": "2026-10-09T00:50:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:79372",
      "initial_release_date": "2026-10-08T17:15:41+00:00",
      "revision_history": [
        {
          "date": "2026-10-08T17:15:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-08T17:15:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-09T00:50:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.19",
                "product": {
                  "name": "Red Hat Satellite 6.19",
                  "product_id": "Red Hat Satellite 6.19",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.19::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-vmaas-rhel9@sha256%3Aeec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vmaas-rhel9\u0026tag=1790820070"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64 as a component of Red Hat Satellite 6.19",
          "product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.19"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-78677",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-25T01:53:26.192779+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2523215"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GitPython. This vulnerability allows a remote attacker to create arbitrary Git directories outside the intended clone destination. By manipulating the `separate_git_dir` parameter during repository cloning, an attacker can redirect repository metadata to an attacker-controlled filesystem path. This could lead to arbitrary directory creation and potentially enable the execution of malicious code through Git hooks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GitPython: GitPython: Arbitrary Code Execution via Path Traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has identified a path traversal vulnerability in GitPython versions before 3.1.59. The vulnerability arises because the `--separate-git-dir` option is not included in the `unsafe_git_clone_options` denylist, allowing attackers who control the `separate_git_dir` parameter during repository cloning to redirect Git repository metadata to arbitrary filesystem locations outside the intended clone destination. This can lead to arbitrary directory and file creation bounded only by process permissions. When combined with subsequent Git operations that trigger hook execution on the redirected repository, this vulnerability can escalate to arbitrary code execution. Exploitation requires that the application passes untrusted, attacker-controlled input to the `separate_git_dir` keyword argument of `Repo.clone_from()` or `Repo.clone()` methods without proper validation, while the `allow_unsafe_options` parameter remains at its default value of False.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78677"
        },
        {
          "category": "external",
          "summary": "RHBZ#2523215",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523215"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78677",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78677"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78677",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78677"
        },
        {
          "category": "external",
          "summary": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc",
          "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir",
          "url": "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir"
        }
      ],
      "release_date": "2026-08-25T01:30:34.719000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-08T17:15:41+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:79372"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, upgrade to GitPython version 3.1.59 or later, which correctly includes `--separate-git-dir` in the unsafe options denylist. If upgrading is not immediately possible, ensure that the `separate_git_dir` parameter is never populated from untrusted or user-controlled sources. Applications should validate and sanitize any input before passing it to GitPython cloning methods, or avoid exposing the `separate_git_dir` parameter to external callers entirely.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vmaas-rhel9@sha256:eec70d9d88191e45d579e79c1bfdcfcf06c30d501c3550632e026d318d698944_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "GitPython: GitPython: Arbitrary Code Execution via Path Traversal"
    }
  ]
}