Red Hat Security AdvisoryRHSA-2020:1454
Satellite 6.7 release.
Released 2020-04-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.7 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.7.1-1.el7sat +47
- Red Hat Satellite Capsule 6.7 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.7.1-1.el7sat +47
Fixes 5 records
Priority MEDIUM 61
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.29082 · Published 2019-08-20 · Partial fix · 1.9.4 CWE-502
Priority MEDIUM 58
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.21949 · Published 2019-05-17 · Partial fix · 2.9.9, 2.8.11.4 +2 CWE-502
Priority LOW 37
Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02125 · Published 2019-10-01 · Partial fix · 2.0.21, 2.1.1 CWE-319
Priority LOW 30
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00768 · Published 2021-05-27 · Fixed CWE-285
Priority LOW 29
The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01348 · Published 2017-12-17 · Partial fix · 0.16.0 CWE-295
THREATIST.IORead the docs